[Webkit-unassigned] [Bug 141267] New: http/tests/misc/detached-frame-console.html is flaky

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=141267

            Bug ID: 141267
           Summary: http/tests/misc/detached-frame-console.html is flaky
    Classification: Unclassified
           Product: WebKit
           Version: 528+ (Nightly build)
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: HTML DOM
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: ap at webkit.org

http/tests/misc/detached-frame-console.html is flaky. In fact, it fails for me locally when run alone.

run-webkit-tests http/tests/misc/detached-frame-console.html

+CONSOLE MESSAGE: line 13: TypeError: undefined is not an object (evaluating 'w.location.foobar')

This flakiness is due to some strange code in JSDOMWindow::getOwnPropertySlot(). It checks thisObject->impl().frame() to decide whether to expose window.location - but the result of frame() depends on whether the Frame object exists, not on any properly observable state! There is a FIXME in DOMWindow saying that it shouldn't be a FrameDestructionObserver.

If something keeps the Frame alive, then we expose window.location, and when we try to access location.foobar, we get a cross-origin violation. And here again, we seem to print it to a wrong console - it should be in the console of a frame that runs the script, not in the console of the target window.

Once all that is cleaned up, there will probably be no way for the test to verify the original fix (for bug 130991). I tried to make another test that confirms the fix, but didn't succeed yet.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150204/6b6c5d51/attachment-0002.html>