Skip to content

StabilityTracer: MobileSafari at Received an invalid message 'WebLockRegistryProxy_ClientIsGoingAway' #66888

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
RupinMittal wants to merge 1 commit into
base: main
Choose a base branch
from
+97 −3
Draft

StabilityTracer: MobileSafari at Received an invalid message 'WebLockRegistryProxy_ClientIsGoingAway' #66888

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 8 additions & 3 deletions Source/WebKit/UIProcess/WebFrameProxy.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -340,8 +340,6 @@ void WebFrameProxy::didFailProvisionalLoad()
void WebFrameProxy::didCommitLoad(const String& contentType, const WebCore::CertificateInfo& certificateInfo, bool containsPluginDocument, DocumentSecurityPolicy&& documentSecurityPolicy, HashSet<WebCore::SecurityOriginData>&& cspOriginsThatUpgradeInsecureNavigations)
{
m_frameLoadState.didCommitLoad();
if (RefPtr page = m_page)
protect(process())->didCommitLoadClientOrigin(ClientOrigin { SecurityOriginData::fromurl("https://github.com/WebKit/WebKit/pull/66888/page->mainFrame(")->url()), SecurityOriginData::fromurl("https://github.com/WebKit/WebKit/pull/66888/m_frameLoadState.url(")) });

if (m_isShowingInitialAboutBlank && !url().isAboutBlank())
m_isShowingInitialAboutBlank = false;
Expand All @@ -352,7 +350,14 @@ void WebFrameProxy::didCommitLoad(const String& contentType, const WebCore::Cert
m_containsPluginDocument = containsPluginDocument;
m_documentSecurityPolicy = WTF::move(documentSecurityPolicy);
m_cspOriginsThatUpgradeInsecureNavigations = WTF::move(cspOriginsThatUpgradeInsecureNavigations);
updateDocumentSecurityOrigin(nullptr);

RefPtr creator = parentFrame() ? parentFrame() : opener();
updateDocumentSecurityOrigin(creator.get());

if (RefPtr page = m_page) {
RefPtr mainFrame = page->mainFrame();
protect(process())->didCommitLoadClientOrigin(ClientOrigin { mainFrame ? mainFrame->documentSecurityOriginData() : SecurityOriginData { }, documentSecurityOriginData() });
}

RefPtr webPage = page();
if (webPage && protect(webPage->preferences())->siteIsolationEnabled())
Expand Down
89 changes: 89 additions & 0 deletions Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WebLocks.mm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@
#import "Helpers/PlatformUtilities.h"
#import "Helpers/Test.h"
#import "Helpers/cocoa/TestNavigationDelegate.h"
#import "Helpers/cocoa/TestUIDelegate.h"
#import "Helpers/cocoa/TestWKWebView.h"
#import "Helpers/Utilities.h"
#import <WebKit/WKPreferencesPrivate.h>
Expand Down Expand Up @@ -361,4 +362,92 @@ static void runLockRequestWaitingOnAnotherPage(ShouldUseSameProcess shouldUseSam
EXPECT_FALSE(webProcessTerminated);
}

TEST(WebLocks, CrossSiteIframeUsingLocksInsideAboutBlankPopup)
{
TestWebKitAPI::HTTPServer server1({ }, TestWebKitAPI::HTTPServer::Protocol::Http);
TestWebKitAPI::HTTPServer server2({ }, TestWebKitAPI::HTTPServer::Protocol::Http);

auto iframeHTML =
"<script>"
" navigator.locks.request('iframe-lock', () => new Promise(() => {}));"
"</script>"_s;

// Opener page: opens an about:blank popup (which inherits server1's origin),
// then injects a cross-site iframe pointing at server2 into that popup.
auto openerHTML = makeString(
"<script>"
" function runTest() {"
" const popup = window.open('');"
" window.popupRef = popup;"
" const f = popup.document.createElement('iframe');"
" f.id = 'subframe';"
" f.src = 'http://localhost:"_s, server2.port(), "/iframe';"
" f.onload = () => webkit.messageHandlers.testHandler.postMessage('IFRAME_READY');"
" popup.document.body.appendChild(f);"
" }"
"</script>"_s);

server1.addResponse("/"_s, { openerHTML });
server2.addResponse("/iframe"_s, { iframeHTML });

// No process swap on navigation keeps the popup in the opener's process.
RetainPtr processPoolConfiguration = adoptNS([[_WKProcessPoolConfiguration alloc] init]);
processPoolConfiguration.get().processSwapsOnNavigation = NO;
RetainPtr processPool = adoptNS([[WKProcessPool alloc] _initWithConfiguration:processPoolConfiguration.get()]);

RetainPtr configuration = adoptNS([[WKWebViewConfiguration alloc] init]);
configuration.get().processPool = processPool.get();
enableWebLocksAPI(configuration.get());
configuration.get().preferences.javaScriptCanOpenWindowsAutomatically = YES;

RetainPtr webView = adoptNS([[TestWKWebView alloc] initWithFrame:NSMakeRect(0, 0, 800, 600) configuration:configuration.get()]);

__block RetainPtr<TestWKWebView> popupWebView;
RetainPtr uiDelegate = adoptNS([TestUIDelegate new]);
uiDelegate.get().createWebViewWithConfiguration = ^WKWebView *(WKWebViewConfiguration *cfg, WKNavigationAction *, WKWindowFeatures *) {
popupWebView = adoptNS([[TestWKWebView alloc] initWithFrame:NSMakeRect(0, 0, 800, 600) configuration:cfg]);
return popupWebView.get();
};
[webView setUIDelegate:uiDelegate.get()];

__block bool done = false;
__block bool webProcessTerminated = false;
RetainPtr navigationDelegate = adoptNS([[TestNavigationDelegate alloc] init]);
navigationDelegate.get().webContentProcessDidTerminate = ^(WKWebView *, _WKProcessTerminationReason) {
webProcessTerminated = true;
done = true;
};
[webView setNavigationDelegate:navigationDelegate.get()];

[webView performAfterReceivingAnyMessage:^(NSString *message) {
if ([message isEqualToString:@"IFRAME_READY"])
done = true;
}];

[webView synchronouslyLoadRequest:server1.request()];
[webView evaluateJavaScript:@"runTest()" completionHandler:nil];
TestWebKitAPI::Util::run(&done);

// Wait long enough for webContentProcessDidTerminate to fire.
TestWebKitAPI::Util::runFor(0.1_s);
EXPECT_FALSE(webProcessTerminated);

// If the WebProcess was terminated by requestLock's MESSAGE_CHECK, we
// have already failed and don't need to check clientIsGoingAway.
if (webProcessTerminated)
return;

// Detaching the iframe will call WebLockRegistryProxy::clientIsGoingAway.
__block bool detachDone = false;
[webView evaluateJavaScript:@"window.popupRef.document.getElementById('subframe').remove(); 1" completionHandler:^(id, NSError *error) {
EXPECT_NULL(error);
detachDone = true;
}];
TestWebKitAPI::Util::run(&detachDone);

// Wait long enough for webContentProcessDidTerminate to fire.
TestWebKitAPI::Util::runFor(0.1_s);
EXPECT_FALSE(webProcessTerminated);
}

} // namespace TestWebKitAPI