[Webkit-unassigned] [Bug 97483] New: It's possible to clone consumable user gestures

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=97483

           Summary: It's possible to clone consumable user gestures
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebCore Misc.
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: jochen at chromium.org
                CC: abarth at webkit.org


Since DOMTimer copies the user gesture state (but does not track whether or not the user gesture is consumed), you can effectively fork it like this:

<script>
function foo() {
 setTimeout(function() { var c = window.open("about:blank"); c.close(); }, 0);
 window.open("data:text/html,pop-under", "", "width=300,height=300");
}
</script>
<button onclick="foo()">Click Me</button>

A port supporting user gesture consumption should only create one window. Since the timeout is created before the first window.open call, however, two windows are created.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.