document.open and document.write must throw while the HTML parser is synchronously...
authorrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 7 Aug 2018 21:13:07 +0000 (21:13 +0000)
committerrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 7 Aug 2018 21:13:07 +0000 (21:13 +0000)
https://bugs.webkit.org/show_bug.cgi?id=187319
<rdar://problem/42843012>

Reviewed by Frédéric Wang.

Source/WebCore:

Make document.open, document.write, document.writeln, and document.close throw InvalidStateError during
a synchronous custom element construction as specified:
https://html.spec.whatwg.org/multipage/parsing.html#create-an-element-for-the-token
https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#throw-on-dynamic-markup-insertion-counter

Tests: fast/custom-elements/throw-on-dynamic-markup-insertion-counter-construct.html
       fast/custom-elements/throw-on-dynamic-markup-insertion-counter-reactions.html

* WebCore.xcodeproj/project.pbxproj:
* dom/Document.cpp:
(WebCore::Document::openForBindings): Throw InvalidStateError when m_throwOnDynamicMarkupInsertionCount is non-zero.
(WebCore::Document::closeForBindings): Ditto.
(WebCore::Document::write): Ditto.
(WebCore::Document::writeln): Ditto.
* dom/Document.h: Re-ordered the related instance variables in the order they appear in the spec, and updated spec URLs.
* dom/ThrowOnDynamicMarkupInsertionCountIncrementer.h: Added.
(WebCore::ThrowOnDynamicMarkupInsertionCountIncrementer): Added.
(WebCore::ThrowOnDynamicMarkupInsertionCountIncrementer::ThrowOnDynamicMarkupInsertionCountIncrementer):
(WebCore::ThrowOnDynamicMarkupInsertionCountIncrementer::~ThrowOnDynamicMarkupInsertionCountIncrementer):
* html/parser/HTMLDocumentParser.cpp:
(WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder): Instantiate ThrowOnDynamicMarkupInsertionCountIncrementer.

LayoutTests:

Added W3C style testharness.js tests. The WPT test added by https://github.com/web-platform-tests/wpt/pull/12037
doesn't test nearly as many edge cases.

* fast/custom-elements/resources/navigation-destination.html: Added.
* fast/custom-elements/throw-on-dynamic-markup-insertion-counter-construct-expected.txt: Added.
* fast/custom-elements/throw-on-dynamic-markup-insertion-counter-construct.html: Added.
* fast/custom-elements/throw-on-dynamic-markup-insertion-counter-reactions-expected.txt: Added.
* fast/custom-elements/throw-on-dynamic-markup-insertion-counter-reactions.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@234669 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/custom-elements/resources/navigation-destination.html [new file with mode: 0644]
LayoutTests/fast/custom-elements/throw-on-dynamic-markup-insertion-counter-construct-expected.txt [new file with mode: 0644]
LayoutTests/fast/custom-elements/throw-on-dynamic-markup-insertion-counter-construct.html [new file with mode: 0644]
LayoutTests/fast/custom-elements/throw-on-dynamic-markup-insertion-counter-reactions-expected.txt [new file with mode: 0644]
LayoutTests/fast/custom-elements/throw-on-dynamic-markup-insertion-counter-reactions.html [new file with mode: 0644]
Source/WebCore/ChangeLog

index 27315aa..fc40b06 100644 (file)
@@ -1,3 +1,20 @@
+2018-08-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        document.open and document.write must throw while the HTML parser is synchronously constructing a custom element
+        https://bugs.webkit.org/show_bug.cgi?id=187319
+        <rdar://problem/42843012>
+
+        Reviewed by Frédéric Wang.
+
+        Added W3C style testharness.js tests. The WPT test added by https://github.com/web-platform-tests/wpt/pull/12037
+        doesn't test nearly as many edge cases.
+
+        * fast/custom-elements/resources/navigation-destination.html: Added.
+        * fast/custom-elements/throw-on-dynamic-markup-insertion-counter-construct-expected.txt: Added.
+        * fast/custom-elements/throw-on-dynamic-markup-insertion-counter-construct.html: Added.
+        * fast/custom-elements/throw-on-dynamic-markup-insertion-counter-reactions-expected.txt: Added.
+        * fast/custom-elements/throw-on-dynamic-markup-insertion-counter-reactions.html: Added.
+
 2018-08-07  Wenson Hsieh  <wenson_hsieh@apple.com>
 
         REGRESSION (r233778): Text selection sometimes cannot be extended in iframes
diff --git a/LayoutTests/fast/custom-elements/resources/navigation-destination.html b/LayoutTests/fast/custom-elements/resources/navigation-destination.html
new file mode 100644 (file)
index 0000000..ede8d2c
--- /dev/null
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>Navigated!</p>
+<script>
+parent.postMessage('didNavigate', '*');
+</script>
+</body>
+</html>
diff --git a/LayoutTests/fast/custom-elements/throw-on-dynamic-markup-insertion-counter-construct-expected.txt b/LayoutTests/fast/custom-elements/throw-on-dynamic-markup-insertion-counter-construct-expected.txt
new file mode 100644 (file)
index 0000000..d976fe7
--- /dev/null
@@ -0,0 +1,13 @@
+
+PASS document.open() must throw an InvalidStateError when synchronously constructing a custom element 
+PASS document.open("text/html") must throw an InvalidStateError when synchronously constructing a custom element 
+PASS document.open(URL) must NOT throw an InvalidStateError when synchronously constructing a custom element 
+PASS document.close() must throw an InvalidStateError when synchronously constructing a custom element 
+PASS document.write must throw an InvalidStateError when synchronously constructing a custom element 
+PASS document.writeln must throw an InvalidStateError when synchronously constructing a custom element 
+PASS document.open() of another document must not throw an InvalidStateError when synchronously constructing a custom element 
+PASS document.open("text/html") of another document must not throw an InvalidStateError when synchronously constructing a custom element 
+PASS document.close() of another document must not throw an InvalidStateError when synchronously constructing a custom element 
+PASS document.write of another document must not throw an InvalidStateError when synchronously constructing a custom element 
+PASS document.writeln of another document must not throw an InvalidStateError when synchronously constructing a custom element 
+
diff --git a/LayoutTests/fast/custom-elements/throw-on-dynamic-markup-insertion-counter-construct.html b/LayoutTests/fast/custom-elements/throw-on-dynamic-markup-insertion-counter-construct.html
new file mode 100644 (file)
index 0000000..aa4c7b0
--- /dev/null
@@ -0,0 +1,117 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Custom Elements: create an element for a token must increment and decrement document's throw-on-dynamic-markup-insertion counter</title>
+<meta name="author" title="Ryosuke Niwa" href="mailto:rniwa@webkit.org">
+<meta name="assert" content="Invoking document.open, document.write, document.writeln, and document.write must throw an exception when the HTML parser is creating a custom element for a token">
+<meta name="help" content="https://html.spec.whatwg.org/multipage/parsing.html#create-an-element-for-the-token">
+<meta name="help" content="https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#throw-on-dynamic-markup-insertion-counter">
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<script src="../../imported/w3c/web-platform-tests/custom-elements/resources/custom-elements-helpers.js"></script>
+</head>
+<body>
+<div id="log"></div>
+<script>
+
+async function construct_custom_element_in_parser(test, call_function)
+{
+    const window = await create_window_in_test(test);
+    const document = window.document;
+
+    document.open();
+
+    let executed = false;
+    let exception = null;
+    class CustomElement extends window.HTMLElement {
+        constructor() {
+            super();
+            try {
+                call_function(document, window);
+            } catch (error) {
+                exception = error;
+            }
+            executed = true;
+        }
+    }
+    window.customElements.define('some-element', CustomElement);
+
+    document.write('<!DOCTYPE html><html><body><some-element></some-element></body></html>');
+    document.close();
+
+    assert_true(executed, 'Must synchronously instantiate a custom element');
+    return {window, document, exception};
+}
+
+promise_test(async function () {
+    const result = await construct_custom_element_in_parser(this, (document) => document.open());
+    assert_throws({name: 'InvalidStateError'}, () => { throw result.exception; }, 'Must throw an InvalidStateError');
+}, 'document.open() must throw an InvalidStateError when synchronously constructing a custom element');
+
+promise_test(async function () {
+    const result = await construct_custom_element_in_parser(this, (document) => document.open('text/html'));
+    assert_throws({name: 'InvalidStateError'}, () => { throw result.exception; }, 'Must throw an InvalidStateError');
+}, 'document.open("text/html") must throw an InvalidStateError when synchronously constructing a custom element');
+
+// https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#dom-document-open-window
+promise_test(async function () {
+    let load_promise = new Promise((resolve) => window.onmessage = (event) => resolve(event.data));
+    const result = await construct_custom_element_in_parser(this, (document, window) => document.open('resources/navigation-destination.html', '_self', ''));
+    assert_equals(result.exception, null);
+    assert_equals(await load_promise, 'didNavigate');
+}, 'document.open(URL) must NOT throw an InvalidStateError when synchronously constructing a custom element');
+
+promise_test(async function () {
+    const result = await construct_custom_element_in_parser(this, (document) => document.close());
+    assert_throws({name: 'InvalidStateError'}, () => { throw result.exception; }, 'Must throw an InvalidStateError');
+}, 'document.close() must throw an InvalidStateError when synchronously constructing a custom element');
+
+promise_test(async function () {
+    const result = await construct_custom_element_in_parser(this, (document) => document.write('<b>some text</b>'));
+    assert_throws({name: 'InvalidStateError'}, () => { throw result.exception; }, 'Must throw an InvalidStateError');
+    assert_equals(result.document.querySelector('b'), null, 'Must not insert new content');
+    assert_false(result.document.documentElement.innerHTML.includes('some text'), 'Must not insert new content');
+}, 'document.write must throw an InvalidStateError when synchronously constructing a custom element');
+
+promise_test(async function () {
+    const result = await construct_custom_element_in_parser(this, (document) => document.writeln('<b>some text</b>'));
+    assert_throws({name: 'InvalidStateError'}, () => { throw result.exception; }, 'Must throw an InvalidStateError');
+    assert_equals(result.document.querySelector('b'), null, 'Must not insert new content');
+    assert_false(result.document.documentElement.innerHTML.includes('some text'), 'Must not insert new content');
+}, 'document.writeln must throw an InvalidStateError when synchronously constructing a custom element');
+
+promise_test(async function () {
+    const another_window = await create_window_in_test(this);
+    const result = await construct_custom_element_in_parser(this, (document) => another_window.document.open());
+    assert_equals(result.exception, null);
+}, 'document.open() of another document must not throw an InvalidStateError when synchronously constructing a custom element');
+
+promise_test(async function () {
+    const another_window = await create_window_in_test(this);
+    const result = await construct_custom_element_in_parser(this, (document) => another_window.document.open('text/html'));
+    assert_equals(result.exception, null);
+}, 'document.open("text/html") of another document must not throw an InvalidStateError when synchronously constructing a custom element');
+
+promise_test(async function () {
+    const another_window = await create_window_in_test(this);
+    const result = await construct_custom_element_in_parser(this, (document) => another_window.document.close());
+    assert_equals(result.exception, null);
+}, 'document.close() of another document must not throw an InvalidStateError when synchronously constructing a custom element');
+
+promise_test(async function () {
+    const another_window = await create_window_in_test(this);
+    const result = await construct_custom_element_in_parser(this, (document) => another_window.document.write('<b>some text</b>'));
+    assert_equals(result.exception, null);
+    assert_equals(another_window.document.querySelector('b').outerHTML, '<b>some text</b>');
+}, 'document.write of another document must not throw an InvalidStateError when synchronously constructing a custom element');
+
+promise_test(async function () {
+    const another_window = await create_window_in_test(this);
+    const result = await construct_custom_element_in_parser(this, (document) => another_window.document.writeln('<b>some text</b>'));
+    assert_equals(result.exception, null);
+    assert_equals(another_window.document.querySelector('b').outerHTML, '<b>some text</b>');
+}, 'document.writeln of another document must not throw an InvalidStateError when synchronously constructing a custom element');
+
+</script>
+</body>
+</html>
diff --git a/LayoutTests/fast/custom-elements/throw-on-dynamic-markup-insertion-counter-reactions-expected.txt b/LayoutTests/fast/custom-elements/throw-on-dynamic-markup-insertion-counter-reactions-expected.txt
new file mode 100644 (file)
index 0000000..e19ed11
--- /dev/null
@@ -0,0 +1,13 @@
+
+PASS document.open() must throw an InvalidStateError when processing custom element reactions for a synchronous constructed custom element 
+PASS document.open("text/html") must throw an InvalidStateError when processing custom element reactions for a synchronous constructed custom element 
+PASS document.open(URL) must NOT throw an InvalidStateError when processing custom element reactions for a synchronous constructed custom element 
+PASS document.close() must throw an InvalidStateError when processing custom element reactions for a synchronous constructed custom element 
+PASS document.write must throw an InvalidStateError when processing custom element reactions for a synchronous constructed custom element 
+PASS document.writeln must throw an InvalidStateError when processing custom element reactions for a synchronous constructed custom element 
+PASS document.open() of another document must not throw an InvalidStateError when processing custom element reactions for a synchronous constructed custom element 
+PASS document.open("text/html") of another document must not throw an InvalidStateError when processing custom element reactions for a synchronous constructed custom element 
+PASS document.close() of another document must not throw an InvalidStateError when processing custom element reactions for a synchronous constructed custom element 
+PASS document.write of another document must not throw an InvalidStateError when processing custom element reactions for a synchronous constructed custom element 
+PASS document.writeln of another document must not throw an InvalidStateError when processing custom element reactions for a synchronous constructed custom element 
+
diff --git a/LayoutTests/fast/custom-elements/throw-on-dynamic-markup-insertion-counter-reactions.html b/LayoutTests/fast/custom-elements/throw-on-dynamic-markup-insertion-counter-reactions.html
new file mode 100644 (file)
index 0000000..c6cd7c6
--- /dev/null
@@ -0,0 +1,117 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Custom Elements: create an element for a token must increment and decrement document's throw-on-dynamic-markup-insertion counter</title>
+<meta name="author" title="Ryosuke Niwa" href="mailto:rniwa@webkit.org">
+<meta name="assert" content="Invoking document.open, document.write, document.writeln, and document.write must throw an exception when the HTML parser is creating a custom element for a token">
+<meta name="help" content="https://html.spec.whatwg.org/multipage/parsing.html#create-an-element-for-the-token">
+<meta name="help" content="https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#throw-on-dynamic-markup-insertion-counter">
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<script src="../../imported/w3c/web-platform-tests/custom-elements/resources/custom-elements-helpers.js"></script>
+</head>
+<body>
+<div id="log"></div>
+<script>
+
+async function custom_element_reactions_in_parser(test, call_function)
+{
+    const window = await create_window_in_test(test);
+    const document = window.document;
+
+    document.open();
+
+    let executed = false;
+    let exception = null;
+    class CustomElement extends window.HTMLElement {
+        attributeChangedCallback(name, oldValue, newValue) {
+            try {
+                call_function(document, window);
+            } catch (error) {
+                exception = error;
+            }
+            executed = true;
+        }
+    }
+    CustomElement.observedAttributes = ['title'];
+    window.customElements.define('some-element', CustomElement);
+
+    document.write('<!DOCTYPE html><html><body><some-element title="some title"></some-element></body></html>');
+    document.close();
+
+    assert_true(executed, 'Must immediately process custom element reactions for setting attributes');
+    return {frameElement, window, document, exception};
+}
+
+promise_test(async function () {
+    const result = await custom_element_reactions_in_parser(this, (document) => document.open());
+    assert_throws({name: 'InvalidStateError'}, () => { throw result.exception; }, 'Must throw an InvalidStateError');
+}, 'document.open() must throw an InvalidStateError when processing custom element reactions for a synchronous constructed custom element');
+
+promise_test(async function () {
+    const result = await custom_element_reactions_in_parser(this, (document) => document.open('text/html'));
+    assert_throws({name: 'InvalidStateError'}, () => { throw result.exception; }, 'Must throw an InvalidStateError');
+}, 'document.open("text/html") must throw an InvalidStateError when processing custom element reactions for a synchronous constructed custom element');
+
+// https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#dom-document-open-window
+promise_test(async function () {
+    let load_promise = new Promise((resolve) => window.onmessage = (event) => resolve(event.data));
+    const result = await custom_element_reactions_in_parser(this, (document, window) => document.open('resources/navigation-destination.html', '_self', ''));
+    assert_equals(result.exception, null);
+    assert_equals(await load_promise, 'didNavigate');
+}, 'document.open(URL) must NOT throw an InvalidStateError when processing custom element reactions for a synchronous constructed custom element');
+
+promise_test(async function () {
+    const result = await custom_element_reactions_in_parser(this, (document) => document.close());
+    assert_throws({name: 'InvalidStateError'}, () => { throw result.exception; }, 'Must throw an InvalidStateError');
+}, 'document.close() must throw an InvalidStateError when processing custom element reactions for a synchronous constructed custom element');
+
+promise_test(async function () {
+    const result = await custom_element_reactions_in_parser(this, (document) => document.write('<b>some text</b>'));
+    assert_throws({name: 'InvalidStateError'}, () => { throw result.exception; }, 'Must throw an InvalidStateError');
+    assert_equals(result.document.querySelector('b'), null, 'Must not insert new content');
+    assert_false(result.document.documentElement.innerHTML.includes('some text'), 'Must not insert new content');
+}, 'document.write must throw an InvalidStateError when processing custom element reactions for a synchronous constructed custom element');
+
+promise_test(async function () {
+    const result = await custom_element_reactions_in_parser(this, (document) => document.writeln('<b>some text</b>'));
+    assert_throws({name: 'InvalidStateError'}, () => { throw result.exception; }, 'Must throw an InvalidStateError');
+    assert_equals(result.document.querySelector('b'), null, 'Must not insert new content');
+    assert_false(result.document.documentElement.innerHTML.includes('some text'), 'Must not insert new content');
+}, 'document.writeln must throw an InvalidStateError when processing custom element reactions for a synchronous constructed custom element');
+
+promise_test(async function () {
+    const another_window = await create_window_in_test(this);
+    const result = await custom_element_reactions_in_parser(this, (document) => another_window.document.open());
+    assert_equals(result.exception, null);
+}, 'document.open() of another document must not throw an InvalidStateError when processing custom element reactions for a synchronous constructed custom element');
+
+promise_test(async function () {
+    const another_window = await create_window_in_test(this);
+    const result = await custom_element_reactions_in_parser(this, (document) => another_window.document.open('text/html'));
+    assert_equals(result.exception, null);
+}, 'document.open("text/html") of another document must not throw an InvalidStateError when processing custom element reactions for a synchronous constructed custom element');
+
+promise_test(async function () {
+    const another_window = await create_window_in_test(this);
+    const result = await custom_element_reactions_in_parser(this, (document) => another_window.document.close());
+    assert_equals(result.exception, null);
+}, 'document.close() of another document must not throw an InvalidStateError when processing custom element reactions for a synchronous constructed custom element');
+
+promise_test(async function () {
+    const another_window = await create_window_in_test(this);
+    const result = await custom_element_reactions_in_parser(this, (document) => another_window.document.write('<b>some text</b>'));
+    assert_equals(result.exception, null);
+    assert_equals(another_window.document.querySelector('b').outerHTML, '<b>some text</b>');
+}, 'document.write of another document must not throw an InvalidStateError when processing custom element reactions for a synchronous constructed custom element');
+
+promise_test(async function () {
+    const another_window = await create_window_in_test(this);
+    const result = await custom_element_reactions_in_parser(this, (document) => another_window.document.writeln('<b>some text</b>'));
+    assert_equals(result.exception, null);
+    assert_equals(another_window.document.querySelector('b').outerHTML, '<b>some text</b>');
+}, 'document.writeln of another document must not throw an InvalidStateError when processing custom element reactions for a synchronous constructed custom element');
+
+</script>
+</body>
+</html>
index ec38d74..b500682 100644 (file)
@@ -1,3 +1,33 @@
+2018-08-06  Ryosuke Niwa  <rniwa@webkit.org>
+
+        document.open and document.write must throw while the HTML parser is synchronously constructing a custom element
+        https://bugs.webkit.org/show_bug.cgi?id=187319
+        <rdar://problem/42843012>
+
+        Reviewed by Frédéric Wang.
+
+        Make document.open, document.write, document.writeln, and document.close throw InvalidStateError during
+        a synchronous custom element construction as specified:
+        https://html.spec.whatwg.org/multipage/parsing.html#create-an-element-for-the-token
+        https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#throw-on-dynamic-markup-insertion-counter
+
+        Tests: fast/custom-elements/throw-on-dynamic-markup-insertion-counter-construct.html
+               fast/custom-elements/throw-on-dynamic-markup-insertion-counter-reactions.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::openForBindings): Throw InvalidStateError when m_throwOnDynamicMarkupInsertionCount is non-zero.
+        (WebCore::Document::closeForBindings): Ditto.
+        (WebCore::Document::write): Ditto.
+        (WebCore::Document::writeln): Ditto.
+        * dom/Document.h: Re-ordered the related instance variables in the order they appear in the spec, and updated spec URLs.
+        * dom/ThrowOnDynamicMarkupInsertionCountIncrementer.h: Added.
+        (WebCore::ThrowOnDynamicMarkupInsertionCountIncrementer): Added.
+        (WebCore::ThrowOnDynamicMarkupInsertionCountIncrementer::ThrowOnDynamicMarkupInsertionCountIncrementer):
+        (WebCore::ThrowOnDynamicMarkupInsertionCountIncrementer::~ThrowOnDynamicMarkupInsertionCountIncrementer):
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder): Instantiate ThrowOnDynamicMarkupInsertionCountIncrementer.
+
 2018-08-07  Ryan Haddad  <ryanhaddad@apple.com>
 
         Unreviewed, suppress warnings to fix the build.