Attachment 421445 Details for Bug 222228 – Patch

[patch] Patch

bug-222228-20210224130149.patch (text/plain), 8.72 KB, created by Chris Dumez on 2021-02-24 13:01:50 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Chris Dumez

Created: 2021-02-24 13:01:50 PST

Size: 8.72 KB

patch

obsolete

>Subversion Revision: 273359
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index fb2179582a37af9d2a7bc1d340fa39ab21a7a0a0..26f29530f87fef25323927e382d63f1dcdfb1c22 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,33 @@
>+2021-02-24  Chris Dumez  <cdumez@apple.com>
>+
>+        Regression(r268700) postMessage changes prototype of basic types
>+        https://bugs.webkit.org/show_bug.cgi?id=222228
>+        <rdar://problem/74612853>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        r268700 updated ScriptExecutionContext::globalObject() to call:
>+        `WebCore::globalObject(mainThreadNormalWorld(), downcast<Document>(*this).page())`
>+        instead of
>+        `frame ? frame->script().globalObject(mainThreadNormalWorld()) : nullptr`
>+
>+        This was not right for subframes because globalObject() gets the globalObject from
>+        the page's main frame instead of the document's frame.
>+
>+        This patch gets rid of the error-prone WebCore::globalObject() taking in a Page*
>+        and replaces it with one taking in a Frame* to avoid such issues in the future.
>+
>+        Test: fast/dom/Window/postMessage-Object-prototype.html
>+
>+        * bindings/js/ScriptState.cpp:
>+        (WebCore::globalObject):
>+        * bindings/js/ScriptState.h:
>+        * dom/ScriptExecutionContext.cpp:
>+        (WebCore::ScriptExecutionContext::globalObject):
>+        * inspector/InspectorFrontendHost.cpp:
>+        (WebCore::InspectorFrontendHost::addSelfToGlobalObjectInWorld):
>+        (WebCore::InspectorFrontendHost::showContextMenu):
>+
> 2021-02-23  Chris Dumez  <cdumez@apple.com>
> 
>         Device motion / orientation events not working in third-party iframes despite Feature-Policy allowing it
>diff --git a/Source/WebCore/bindings/js/ScriptState.cpp b/Source/WebCore/bindings/js/ScriptState.cpp
>index b7af0bd2cc876bba38ae49a1f7812a4700e2fe8d..d3e48edaa78b1ac62dfa87b551d2aef9b8c4fb03 100644
>--- a/Source/WebCore/bindings/js/ScriptState.cpp
>+++ b/Source/WebCore/bindings/js/ScriptState.cpp
>@@ -92,9 +92,9 @@ JSC::JSGlobalObject* globalObject(DOMWrapperWorld& world, Node* node)
>     return frame->script().globalObject(world);
> }
> 
>-JSC::JSGlobalObject* globalObject(DOMWrapperWorld& world, Page* page)
>+JSC::JSGlobalObject* globalObject(DOMWrapperWorld& world, Frame* frame)
> {
>-    return page ? page->mainFrame().script().globalObject(world) : nullptr;
>+    return frame ? frame->script().globalObject(world) : nullptr;
> }
> 
> JSC::JSGlobalObject* globalObject(WorkerOrWorkletGlobalScope& workerOrWorkletGlobalScope)
>diff --git a/Source/WebCore/bindings/js/ScriptState.h b/Source/WebCore/bindings/js/ScriptState.h
>index 05d0331807950ee3100ff5b211814020419c4401..d1506309960b9281ed1002193753fc925adc4082 100644
>--- a/Source/WebCore/bindings/js/ScriptState.h
>+++ b/Source/WebCore/bindings/js/ScriptState.h
>@@ -42,7 +42,6 @@ class DOMWindow;
> class DOMWrapperWorld;
> class Frame;
> class Node;
>-class Page;
> class ScriptExecutionContext;
> class WorkerOrWorkletGlobalScope;
> 
>@@ -53,7 +52,7 @@ ScriptExecutionContext* scriptExecutionContextFromExecState(JSC::JSGlobalObject*
> JSC::JSGlobalObject* mainWorldExecState(Frame*);
> 
> JSC::JSGlobalObject* globalObject(DOMWrapperWorld&, Node*);
>-WEBCORE_EXPORT JSC::JSGlobalObject* globalObject(DOMWrapperWorld&, Page*);
>+WEBCORE_EXPORT JSC::JSGlobalObject* globalObject(DOMWrapperWorld&, Frame*);
> JSC::JSGlobalObject* globalObject(WorkerOrWorkletGlobalScope&);
> 
> } // namespace WebCore
>diff --git a/Source/WebCore/dom/ScriptExecutionContext.cpp b/Source/WebCore/dom/ScriptExecutionContext.cpp
>index a89b74ec7d395f3f8313e5a46fa8d7211d387bd7..d2717bf7831f4fb5d78f050c94b4aa6712cb69d8 100644
>--- a/Source/WebCore/dom/ScriptExecutionContext.cpp
>+++ b/Source/WebCore/dom/ScriptExecutionContext.cpp
>@@ -512,7 +512,7 @@ bool ScriptExecutionContext::hasPendingActivity() const
> JSC::JSGlobalObject* ScriptExecutionContext::globalObject()
> {
>     if (is<Document>(*this))
>-        return WebCore::globalObject(mainThreadNormalWorld(), downcast<Document>(*this).page());
>+        return WebCore::globalObject(mainThreadNormalWorld(), downcast<Document>(*this).frame());
> 
>     if (is<WorkerOrWorkletGlobalScope>(*this))
>         return WebCore::globalObject(downcast<WorkerOrWorkletGlobalScope>(*this));
>diff --git a/Source/WebCore/inspector/InspectorFrontendHost.cpp b/Source/WebCore/inspector/InspectorFrontendHost.cpp
>index 00d62cf47196e8e77932dfc857d20cb01482b161..180cdba8453e31bff15fbcb952a7c16dbc5f028d 100644
>--- a/Source/WebCore/inspector/InspectorFrontendHost.cpp
>+++ b/Source/WebCore/inspector/InspectorFrontendHost.cpp
>@@ -158,7 +158,7 @@ void InspectorFrontendHost::disconnectClient()
> 
> void InspectorFrontendHost::addSelfToGlobalObjectInWorld(DOMWrapperWorld& world)
> {
>-    auto& lexicalGlobalObject = *globalObject(world, m_frontendPage);
>+    auto& lexicalGlobalObject = *globalObject(world, m_frontendPage ? &m_frontendPage->mainFrame() : nullptr);
>     auto& vm = lexicalGlobalObject.vm();
>     JSC::JSLockHolder lock(vm);
>     auto scope = DECLARE_CATCH_SCOPE(vm);
>@@ -503,7 +503,7 @@ void InspectorFrontendHost::showContextMenu(Event& event, Vector<ContextMenuItem
> #if ENABLE(CONTEXT_MENUS)
>     ASSERT(m_frontendPage);
> 
>-    auto& lexicalGlobalObject = *globalObject(debuggerWorld(), m_frontendPage);
>+    auto& lexicalGlobalObject = *globalObject(debuggerWorld(), &m_frontendPage->mainFrame());
>     auto& vm = lexicalGlobalObject.vm();
>     auto value = lexicalGlobalObject.get(&lexicalGlobalObject, JSC::Identifier::fromString(vm, "InspectorFrontendAPI"));
>     ASSERT(value);
>diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
>index ff77ff19f1e517dab45c54c4b92b30f41dc1312b..a1f3d3f108eaf20bddfc57d97e35131c44747b6b 100644
>--- a/LayoutTests/ChangeLog
>+++ b/LayoutTests/ChangeLog
>@@ -1,3 +1,17 @@
>+2021-02-24  Chris Dumez  <cdumez@apple.com>
>+
>+        Regression(r268700) postMessage changes prototype of basic types
>+        https://bugs.webkit.org/show_bug.cgi?id=222228
>+        <rdar://problem/74612853>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Add layout test coverage.
>+
>+        * fast/dom/Window/postMessage-Object-prototype-expected.txt: Added.
>+        * fast/dom/Window/postMessage-Object-prototype.html: Added.
>+        * fast/dom/Window/resources/postMessage-Object-prototype-frame.html: Added.
>+
> 2021-02-23  Chris Dumez  <cdumez@apple.com>
> 
>         Device motion / orientation events not working in third-party iframes despite Feature-Policy allowing it
>diff --git a/LayoutTests/fast/dom/Window/postMessage-Object-prototype-expected.txt b/LayoutTests/fast/dom/Window/postMessage-Object-prototype-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..b1f32765613ac6bfdd50a390598ec8406b1079bf
>--- /dev/null
>+++ b/LayoutTests/fast/dom/Window/postMessage-Object-prototype-expected.txt
>@@ -0,0 +1,11 @@
>+Tests that the prototype of objects serialized via postMessage is correct.
>+
>+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
>+
>+
>+PASS event.data instanceof Object
>+PASS event.data.array instanceof Array
>+PASS successfullyParsed is true
>+
>+TEST COMPLETE
>+
>diff --git a/LayoutTests/fast/dom/Window/postMessage-Object-prototype.html b/LayoutTests/fast/dom/Window/postMessage-Object-prototype.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..0d858eae9de2fa22720cf21e92708f04a7948c32
>--- /dev/null
>+++ b/LayoutTests/fast/dom/Window/postMessage-Object-prototype.html
>@@ -0,0 +1,16 @@
>+<!DOCTYPE html>
>+<html>
>+<script src="../../../resources/js-test.js"></script>
>+<body>
>+<script>
>+description("Tests that the prototype of objects serialized via postMessage is correct.");
>+jsTestIsAsync = true;
>+
>+onload = () => {
>+    let testFrame = document.createElement("iframe");
>+    testFrame.src = "resources/postMessage-Object-prototype-frame.html";
>+    document.body.append(testFrame);
>+};
>+</script>
>+</body>
>+</html>
>diff --git a/LayoutTests/fast/dom/Window/resources/postMessage-Object-prototype-frame.html b/LayoutTests/fast/dom/Window/resources/postMessage-Object-prototype-frame.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..5526baac8a695cdb8c140ea69d55108dca9266a8
>--- /dev/null
>+++ b/LayoutTests/fast/dom/Window/resources/postMessage-Object-prototype-frame.html
>@@ -0,0 +1,23 @@
>+<!DOCTYPE html>
>+<html>
>+<body>
>+<script>
>+window.addEventListener('message', event => {
>+    if (event.data instanceof Object)
>+        top.testPassed("event.data instanceof Object");
>+    else
>+        top.testFailed("event.data instanceof Object");
>+    if (event.data.array instanceof Array)
>+        top.testPassed("event.data.array instanceof Array");
>+    else
>+        top.testFailed("event.data.array instanceof Array");
>+    top.finishJSTest();
>+})
>+
>+const testObject = {
>+    array: [ 1, 2, 3, 4 ]
>+};
>+window.postMessage(testObject);
>+</script>
>+</body>
>+</html>

Actions: View | Formatted Diff | Diff

Attachments on bug 222228: 421445