Soften push/replaceState frequency restrictions.
authorbeidson@apple.com <beidson@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 25 Mar 2016 20:37:49 +0000 (20:37 +0000)
committerbeidson@apple.com <beidson@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 25 Mar 2016 20:37:49 +0000 (20:37 +0000)
<rdar://problem/25228439> and https://bugs.webkit.org/show_bug.cgi?id=155901
.:

Rubber-stamped by Timothy Hatcher.

* ManualTests/state-objects-time-limit.html: Added.

Source/WebCore:

Rubber-stamped by Timothy Hatcher.

Covered by existing LayoutTests and a new Manual Test.

* page/History.cpp:
(WebCore::History::stateObjectAdded): Allow 100 state object operations every 30 seconds.
* page/History.h:

LayoutTests:

Rubber-stamped by Timothy Hatcher.

* fast/loader/stateobjects/pushstate-frequency-with-user-gesture-expected.txt: Removed.
* fast/loader/stateobjects/pushstate-frequency-with-user-gesture.html: Removed.
* fast/loader/stateobjects/replacestate-frequency-with-user-gesture-expected.txt: Removed.
* fast/loader/stateobjects/replacestate-frequency-with-user-gesture.html: Removed.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@198687 268f45cc-cd09-0410-ab3c-d52691b4dbfc

ChangeLog
LayoutTests/ChangeLog
LayoutTests/fast/loader/stateobjects/pushstate-frequency-with-user-gesture-expected.txt [deleted file]
LayoutTests/fast/loader/stateobjects/pushstate-frequency-with-user-gesture.html [deleted file]
LayoutTests/fast/loader/stateobjects/replacestate-frequency-with-user-gesture-expected.txt [deleted file]
LayoutTests/fast/loader/stateobjects/replacestate-frequency-with-user-gesture.html [deleted file]
ManualTests/state-objects-time-limit.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/page/History.cpp
Source/WebCore/page/History.h

index 7791c70..b021545 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,12 @@
+2016-03-25  Brady Eidson  <beidson@apple.com>
+
+        Soften push/replaceState frequency restrictions.
+        <rdar://problem/25228439> and https://bugs.webkit.org/show_bug.cgi?id=155901
+        
+        Rubber-stamped by Timothy Hatcher.
+
+        * ManualTests/state-objects-time-limit.html: Added.
+
 2016-03-25  Daniel Bates  <dabates@apple.com>
 
         REGRESSION (r197358): WebKitSystemInterface.h copied into directory named "--llvm"
index 121c88e..6109366 100644 (file)
@@ -1,3 +1,15 @@
+2016-03-25  Brady Eidson  <beidson@apple.com>
+
+        Soften push/replaceState frequency restrictions.
+        <rdar://problem/25228439> and https://bugs.webkit.org/show_bug.cgi?id=155901
+
+        Rubber-stamped by Timothy Hatcher.
+
+        * fast/loader/stateobjects/pushstate-frequency-with-user-gesture-expected.txt: Removed.
+        * fast/loader/stateobjects/pushstate-frequency-with-user-gesture.html: Removed.
+        * fast/loader/stateobjects/replacestate-frequency-with-user-gesture-expected.txt: Removed.
+        * fast/loader/stateobjects/replacestate-frequency-with-user-gesture.html: Removed.
+
 2016-03-23  Dave Hyatt  <hyatt@apple.com>
 
         Implement the allow-end value of the hanging-punctuation CSS property.
diff --git a/LayoutTests/fast/loader/stateobjects/pushstate-frequency-with-user-gesture-expected.txt b/LayoutTests/fast/loader/stateobjects/pushstate-frequency-with-user-gesture-expected.txt
deleted file mode 100644 (file)
index 28dc476..0000000
+++ /dev/null
@@ -1,206 +0,0 @@
-Test should complete quickly and not crash.
-Click to test pushState through a user gesture
-Successfully added item: 0
-Successfully added item: 1
-Successfully added item: 2
-Successfully added item: 3
-Successfully added item: 4
-Successfully added item: 5
-Successfully added item: 6
-Successfully added item: 7
-Successfully added item: 8
-Successfully added item: 9
-Successfully added item: 10
-Successfully added item: 11
-Successfully added item: 12
-Successfully added item: 13
-Successfully added item: 14
-Successfully added item: 15
-Successfully added item: 16
-Successfully added item: 17
-Successfully added item: 18
-Successfully added item: 19
-Successfully added item: 20
-Successfully added item: 21
-Successfully added item: 22
-Successfully added item: 23
-Successfully added item: 24
-Successfully added item: 25
-Successfully added item: 26
-Successfully added item: 27
-Successfully added item: 28
-Successfully added item: 29
-Successfully added item: 30
-Successfully added item: 31
-Successfully added item: 32
-Successfully added item: 33
-Successfully added item: 34
-Successfully added item: 35
-Successfully added item: 36
-Successfully added item: 37
-Successfully added item: 38
-Successfully added item: 39
-Successfully added item: 40
-Successfully added item: 41
-Successfully added item: 42
-Successfully added item: 43
-Successfully added item: 44
-Successfully added item: 45
-Successfully added item: 46
-Successfully added item: 47
-Successfully added item: 48
-Successfully added item: 49
-Successfully added item: 50
-Successfully added item: 51
-Successfully added item: 52
-Successfully added item: 53
-Successfully added item: 54
-Successfully added item: 55
-Successfully added item: 56
-Successfully added item: 57
-Successfully added item: 58
-Successfully added item: 59
-Successfully added item: 60
-Successfully added item: 61
-Successfully added item: 62
-Successfully added item: 63
-Successfully added item: 64
-Successfully added item: 65
-Successfully added item: 66
-Successfully added item: 67
-Successfully added item: 68
-Successfully added item: 69
-Successfully added item: 70
-Successfully added item: 71
-Successfully added item: 72
-Successfully added item: 73
-Successfully added item: 74
-Successfully added item: 75
-Successfully added item: 76
-Successfully added item: 77
-Successfully added item: 78
-Successfully added item: 79
-Successfully added item: 80
-Successfully added item: 81
-Successfully added item: 82
-Successfully added item: 83
-Successfully added item: 84
-Successfully added item: 85
-Successfully added item: 86
-Successfully added item: 87
-Successfully added item: 88
-Successfully added item: 89
-Successfully added item: 90
-Successfully added item: 91
-Successfully added item: 92
-Successfully added item: 93
-Successfully added item: 94
-Successfully added item: 95
-Successfully added item: 96
-Successfully added item: 97
-Successfully added item: 98
-Successfully added item: 99
-Error: SecurityError: DOM Exception 18
-Successfully added user gesture item: 0
-Successfully added user gesture item: 1
-Successfully added user gesture item: 2
-Successfully added user gesture item: 3
-Successfully added user gesture item: 4
-Successfully added user gesture item: 5
-Successfully added user gesture item: 6
-Successfully added user gesture item: 7
-Successfully added user gesture item: 8
-Successfully added user gesture item: 9
-Successfully added user gesture item: 10
-Successfully added user gesture item: 11
-Successfully added user gesture item: 12
-Successfully added user gesture item: 13
-Successfully added user gesture item: 14
-Successfully added user gesture item: 15
-Successfully added user gesture item: 16
-Successfully added user gesture item: 17
-Successfully added user gesture item: 18
-Successfully added user gesture item: 19
-Successfully added user gesture item: 20
-Successfully added user gesture item: 21
-Successfully added user gesture item: 22
-Successfully added user gesture item: 23
-Successfully added user gesture item: 24
-Successfully added user gesture item: 25
-Successfully added user gesture item: 26
-Successfully added user gesture item: 27
-Successfully added user gesture item: 28
-Successfully added user gesture item: 29
-Successfully added user gesture item: 30
-Successfully added user gesture item: 31
-Successfully added user gesture item: 32
-Successfully added user gesture item: 33
-Successfully added user gesture item: 34
-Successfully added user gesture item: 35
-Successfully added user gesture item: 36
-Successfully added user gesture item: 37
-Successfully added user gesture item: 38
-Successfully added user gesture item: 39
-Successfully added user gesture item: 40
-Successfully added user gesture item: 41
-Successfully added user gesture item: 42
-Successfully added user gesture item: 43
-Successfully added user gesture item: 44
-Successfully added user gesture item: 45
-Successfully added user gesture item: 46
-Successfully added user gesture item: 47
-Successfully added user gesture item: 48
-Successfully added user gesture item: 49
-Successfully added user gesture item: 50
-Successfully added user gesture item: 51
-Successfully added user gesture item: 52
-Successfully added user gesture item: 53
-Successfully added user gesture item: 54
-Successfully added user gesture item: 55
-Successfully added user gesture item: 56
-Successfully added user gesture item: 57
-Successfully added user gesture item: 58
-Successfully added user gesture item: 59
-Successfully added user gesture item: 60
-Successfully added user gesture item: 61
-Successfully added user gesture item: 62
-Successfully added user gesture item: 63
-Successfully added user gesture item: 64
-Successfully added user gesture item: 65
-Successfully added user gesture item: 66
-Successfully added user gesture item: 67
-Successfully added user gesture item: 68
-Successfully added user gesture item: 69
-Successfully added user gesture item: 70
-Successfully added user gesture item: 71
-Successfully added user gesture item: 72
-Successfully added user gesture item: 73
-Successfully added user gesture item: 74
-Successfully added user gesture item: 75
-Successfully added user gesture item: 76
-Successfully added user gesture item: 77
-Successfully added user gesture item: 78
-Successfully added user gesture item: 79
-Successfully added user gesture item: 80
-Successfully added user gesture item: 81
-Successfully added user gesture item: 82
-Successfully added user gesture item: 83
-Successfully added user gesture item: 84
-Successfully added user gesture item: 85
-Successfully added user gesture item: 86
-Successfully added user gesture item: 87
-Successfully added user gesture item: 88
-Successfully added user gesture item: 89
-Successfully added user gesture item: 90
-Successfully added user gesture item: 91
-Successfully added user gesture item: 92
-Successfully added user gesture item: 93
-Successfully added user gesture item: 94
-Successfully added user gesture item: 95
-Successfully added user gesture item: 96
-Successfully added user gesture item: 97
-Successfully added user gesture item: 98
-Successfully added user gesture item: 99
-User gesture: Error: SecurityError: DOM Exception 18
-Test complete
-
diff --git a/LayoutTests/fast/loader/stateobjects/pushstate-frequency-with-user-gesture.html b/LayoutTests/fast/loader/stateobjects/pushstate-frequency-with-user-gesture.html
deleted file mode 100644 (file)
index 29768f3..0000000
+++ /dev/null
@@ -1,51 +0,0 @@
-<script>
-
-if (window.testRunner) {
-    testRunner.dumpAsText();
-    testRunner.waitUntilDone();
-}
-
-function log(msg) {
-    document.getElementById("logger").innerHTML += msg + "<br>";
-}
-
-window.onload = function()
-{
-    try {
-        for( var i = 0; i < 100000; ++i ) {
-            history.pushState(0, 0, i);
-            log("Successfully added item: " + i);
-        }
-    } catch (e) {
-        log(e);
-    }
-    
-    var button = document.getElementById("button");
-    eventSender.mouseMoveTo(button.offsetLeft + 5, button.offsetTop + 5);
-    eventSender.mouseDown();
-    eventSender.mouseUp();
-}
-
-function clicked()
-{
-    try {
-        for( var i = 0; i < 100000; ++i ) {
-            history.pushState(0, 0, i);
-            log("Successfully added user gesture item: " + i);
-        }
-    } catch (e) {
-        log("User gesture: " + e);
-    }
-
-    if (window.testRunner)
-        testRunner.notifyDone();
-
-    log("Test complete");
-}
-
-</script>
-<body>
-Test should complete quickly and not crash.<br>
-<button id="button" onclick="clicked();">Click to test pushState through a user gesture</button>
-<div id="logger"></div>
-</body>
diff --git a/LayoutTests/fast/loader/stateobjects/replacestate-frequency-with-user-gesture-expected.txt b/LayoutTests/fast/loader/stateobjects/replacestate-frequency-with-user-gesture-expected.txt
deleted file mode 100644 (file)
index 4f7f052..0000000
+++ /dev/null
@@ -1,206 +0,0 @@
-Test should complete quickly and not crash.
-Click to test replaceState through a user gesture
-Successfully added item: 0
-Successfully added item: 1
-Successfully added item: 2
-Successfully added item: 3
-Successfully added item: 4
-Successfully added item: 5
-Successfully added item: 6
-Successfully added item: 7
-Successfully added item: 8
-Successfully added item: 9
-Successfully added item: 10
-Successfully added item: 11
-Successfully added item: 12
-Successfully added item: 13
-Successfully added item: 14
-Successfully added item: 15
-Successfully added item: 16
-Successfully added item: 17
-Successfully added item: 18
-Successfully added item: 19
-Successfully added item: 20
-Successfully added item: 21
-Successfully added item: 22
-Successfully added item: 23
-Successfully added item: 24
-Successfully added item: 25
-Successfully added item: 26
-Successfully added item: 27
-Successfully added item: 28
-Successfully added item: 29
-Successfully added item: 30
-Successfully added item: 31
-Successfully added item: 32
-Successfully added item: 33
-Successfully added item: 34
-Successfully added item: 35
-Successfully added item: 36
-Successfully added item: 37
-Successfully added item: 38
-Successfully added item: 39
-Successfully added item: 40
-Successfully added item: 41
-Successfully added item: 42
-Successfully added item: 43
-Successfully added item: 44
-Successfully added item: 45
-Successfully added item: 46
-Successfully added item: 47
-Successfully added item: 48
-Successfully added item: 49
-Successfully added item: 50
-Successfully added item: 51
-Successfully added item: 52
-Successfully added item: 53
-Successfully added item: 54
-Successfully added item: 55
-Successfully added item: 56
-Successfully added item: 57
-Successfully added item: 58
-Successfully added item: 59
-Successfully added item: 60
-Successfully added item: 61
-Successfully added item: 62
-Successfully added item: 63
-Successfully added item: 64
-Successfully added item: 65
-Successfully added item: 66
-Successfully added item: 67
-Successfully added item: 68
-Successfully added item: 69
-Successfully added item: 70
-Successfully added item: 71
-Successfully added item: 72
-Successfully added item: 73
-Successfully added item: 74
-Successfully added item: 75
-Successfully added item: 76
-Successfully added item: 77
-Successfully added item: 78
-Successfully added item: 79
-Successfully added item: 80
-Successfully added item: 81
-Successfully added item: 82
-Successfully added item: 83
-Successfully added item: 84
-Successfully added item: 85
-Successfully added item: 86
-Successfully added item: 87
-Successfully added item: 88
-Successfully added item: 89
-Successfully added item: 90
-Successfully added item: 91
-Successfully added item: 92
-Successfully added item: 93
-Successfully added item: 94
-Successfully added item: 95
-Successfully added item: 96
-Successfully added item: 97
-Successfully added item: 98
-Successfully added item: 99
-Error: SecurityError: DOM Exception 18
-Successfully added user gesture item: 0
-Successfully added user gesture item: 1
-Successfully added user gesture item: 2
-Successfully added user gesture item: 3
-Successfully added user gesture item: 4
-Successfully added user gesture item: 5
-Successfully added user gesture item: 6
-Successfully added user gesture item: 7
-Successfully added user gesture item: 8
-Successfully added user gesture item: 9
-Successfully added user gesture item: 10
-Successfully added user gesture item: 11
-Successfully added user gesture item: 12
-Successfully added user gesture item: 13
-Successfully added user gesture item: 14
-Successfully added user gesture item: 15
-Successfully added user gesture item: 16
-Successfully added user gesture item: 17
-Successfully added user gesture item: 18
-Successfully added user gesture item: 19
-Successfully added user gesture item: 20
-Successfully added user gesture item: 21
-Successfully added user gesture item: 22
-Successfully added user gesture item: 23
-Successfully added user gesture item: 24
-Successfully added user gesture item: 25
-Successfully added user gesture item: 26
-Successfully added user gesture item: 27
-Successfully added user gesture item: 28
-Successfully added user gesture item: 29
-Successfully added user gesture item: 30
-Successfully added user gesture item: 31
-Successfully added user gesture item: 32
-Successfully added user gesture item: 33
-Successfully added user gesture item: 34
-Successfully added user gesture item: 35
-Successfully added user gesture item: 36
-Successfully added user gesture item: 37
-Successfully added user gesture item: 38
-Successfully added user gesture item: 39
-Successfully added user gesture item: 40
-Successfully added user gesture item: 41
-Successfully added user gesture item: 42
-Successfully added user gesture item: 43
-Successfully added user gesture item: 44
-Successfully added user gesture item: 45
-Successfully added user gesture item: 46
-Successfully added user gesture item: 47
-Successfully added user gesture item: 48
-Successfully added user gesture item: 49
-Successfully added user gesture item: 50
-Successfully added user gesture item: 51
-Successfully added user gesture item: 52
-Successfully added user gesture item: 53
-Successfully added user gesture item: 54
-Successfully added user gesture item: 55
-Successfully added user gesture item: 56
-Successfully added user gesture item: 57
-Successfully added user gesture item: 58
-Successfully added user gesture item: 59
-Successfully added user gesture item: 60
-Successfully added user gesture item: 61
-Successfully added user gesture item: 62
-Successfully added user gesture item: 63
-Successfully added user gesture item: 64
-Successfully added user gesture item: 65
-Successfully added user gesture item: 66
-Successfully added user gesture item: 67
-Successfully added user gesture item: 68
-Successfully added user gesture item: 69
-Successfully added user gesture item: 70
-Successfully added user gesture item: 71
-Successfully added user gesture item: 72
-Successfully added user gesture item: 73
-Successfully added user gesture item: 74
-Successfully added user gesture item: 75
-Successfully added user gesture item: 76
-Successfully added user gesture item: 77
-Successfully added user gesture item: 78
-Successfully added user gesture item: 79
-Successfully added user gesture item: 80
-Successfully added user gesture item: 81
-Successfully added user gesture item: 82
-Successfully added user gesture item: 83
-Successfully added user gesture item: 84
-Successfully added user gesture item: 85
-Successfully added user gesture item: 86
-Successfully added user gesture item: 87
-Successfully added user gesture item: 88
-Successfully added user gesture item: 89
-Successfully added user gesture item: 90
-Successfully added user gesture item: 91
-Successfully added user gesture item: 92
-Successfully added user gesture item: 93
-Successfully added user gesture item: 94
-Successfully added user gesture item: 95
-Successfully added user gesture item: 96
-Successfully added user gesture item: 97
-Successfully added user gesture item: 98
-Successfully added user gesture item: 99
-User gesture: Error: SecurityError: DOM Exception 18
-Test complete
-
diff --git a/LayoutTests/fast/loader/stateobjects/replacestate-frequency-with-user-gesture.html b/LayoutTests/fast/loader/stateobjects/replacestate-frequency-with-user-gesture.html
deleted file mode 100644 (file)
index efdc1a2..0000000
+++ /dev/null
@@ -1,51 +0,0 @@
-<script>
-
-if (window.testRunner) {
-    testRunner.dumpAsText();
-    testRunner.waitUntilDone();
-}
-
-function log(msg) {
-    document.getElementById("logger").innerHTML += msg + "<br>";
-}
-
-window.onload = function()
-{
-    try {
-        for( var i = 0; i < 100000; ++i ) {
-            history.replaceState(0, 0, i);
-            log("Successfully added item: " + i);
-        }
-    } catch (e) {
-        log(e);
-    }
-    
-    var button = document.getElementById("button");
-    eventSender.mouseMoveTo(button.offsetLeft + 5, button.offsetTop + 5);
-    eventSender.mouseDown();
-    eventSender.mouseUp();
-}
-
-function clicked()
-{
-    try {
-        for( var i = 0; i < 100000; ++i ) {
-            history.replaceState(0, 0, i);
-            log("Successfully added user gesture item: " + i);
-        }
-    } catch (e) {
-        log("User gesture: " + e);
-    }
-
-    if (window.testRunner)
-        testRunner.notifyDone();
-
-    log("Test complete");
-}
-
-</script>
-<body>
-Test should complete quickly and not crash.<br>
-<button id="button" onclick="clicked();">Click to test replaceState through a user gesture</button>
-<div id="logger"></div>
-</body>
diff --git a/ManualTests/state-objects-time-limit.html b/ManualTests/state-objects-time-limit.html
new file mode 100644 (file)
index 0000000..5cc44e3
--- /dev/null
@@ -0,0 +1,51 @@
+<script>
+
+function log(msg) {
+    document.getElementById("logger").innerHTML += msg + " -- ";
+}
+
+function startTest() {
+    try {
+        for (var i = 0; i < 101; ++i) {
+            history.pushState(0, 0, i.toString());
+            log("Successfully added item: " + i);
+        }
+    } catch(e) {
+        log(e);
+    }
+
+    setTimeout(continueTest, 30050);
+}
+
+function continueTest() {
+    alert(1);
+    history.pushState(0, 0, "101");
+    log("After 30+ second delay, successfully added the 101th item");
+
+    try {
+        for (var i = 0; i < 100; ++i) {
+            history.replaceState(0, 0, i.toString());
+            log("Successfully replaced with item: " + i);
+        }
+    } catch(e) {
+        alert(2);
+        log(e);
+    }
+
+    setTimeout(finishTest, 30050);
+}
+
+function finishTest() {
+    alert(3);
+    history.replaceState(0, 0, "100");
+    log("After 30+ second delay, successfully replaced the 100th item");
+}
+
+</script>
+This test will take over a minute to run.<br>
+100 items should successfully push, and the 101th should fail.<br>
+After 30+ seconds, 101th should successfully push.<br>
+Then 99 items should successfully replace, with the 100th failing.<br>
+After 30+ seconds, the 100th should successfully replace.<br>
+<button onclick="startTest();">Click to start test</button>
+<div id="logger"></div>
\ No newline at end of file
index 74b3ceb..6c0963d 100644 (file)
@@ -1,3 +1,16 @@
+2016-03-25  Brady Eidson  <beidson@apple.com>
+
+        Soften push/replaceState frequency restrictions.
+        <rdar://problem/25228439> and https://bugs.webkit.org/show_bug.cgi?id=155901
+
+        Rubber-stamped by Timothy Hatcher.
+
+        Covered by existing LayoutTests and a new Manual Test.
+
+        * page/History.cpp:
+        (WebCore::History::stateObjectAdded): Allow 100 state object operations every 30 seconds.
+        * page/History.h:
+
 2016-03-24  Enrica Casucci  <enrica@apple.com>
 
         Data Detection creates multiple links even when the detected content is within the same node.
index 874adcb..292763f 100644 (file)
@@ -140,7 +140,8 @@ void History::stateObjectAdded(PassRefPtr<SerializedScriptValue> data, const Str
 {
     // Each unique main-frame document is only allowed to send 64mb of state object payload to the UI client/process.
     static uint32_t totalStateObjectPayloadLimit = 0x4000000;
-    static unsigned perUserGestureStateObjectLimit = 100;
+    static double stateObjectTimeSpan = 30.0;
+    static unsigned perStateObjectTimeSpanLimit = 100;
 
     if (!m_frame || !m_frame->page())
         return;
@@ -161,33 +162,21 @@ void History::stateObjectAdded(PassRefPtr<SerializedScriptValue> data, const Str
     if (!mainHistory)
         return;
 
-    bool processingUserGesture = ScriptController::processingUserGesture();
-    if (!processingUserGesture && mainHistory->m_nonUserGestureObjectsAdded >= perUserGestureStateObjectLimit) {
+    double currentTimestamp = currentTime();
+    if (currentTimestamp - mainHistory->m_currentStateObjectTimeSpanStart > stateObjectTimeSpan) {
+        mainHistory->m_currentStateObjectTimeSpanStart = currentTimestamp;
+        mainHistory->m_currentStateObjectTimeSpanObjectsAdded = 0;
+    }
+    
+    if (mainHistory->m_currentStateObjectTimeSpanObjectsAdded >= perStateObjectTimeSpanLimit) {
         ec.code = SECURITY_ERR;
         if (stateObjectType == StateObjectType::Replace)
-            ec.message = String::format("Attempt to use history.replaceState() more than %u times without a user gesture", perUserGestureStateObjectLimit);
+            ec.message = String::format("Attempt to use history.replaceState() more than %u times per %f seconds", perStateObjectTimeSpanLimit, stateObjectTimeSpan);
         else
-            ec.message = String::format("Attempt to use history.pushState() more than %u times without a user gesture", perUserGestureStateObjectLimit);
+            ec.message = String::format("Attempt to use history.pushState() more than %u times per %f seconds", perStateObjectTimeSpanLimit, stateObjectTimeSpan);
         return;
     }
 
-    double userGestureTimestamp = mainDocument->lastHandledUserGestureTimestamp();
-    if (processingUserGesture) {
-        if (mainHistory->m_currentUserGestureTimestamp < userGestureTimestamp) {
-            mainHistory->m_currentUserGestureTimestamp = userGestureTimestamp;
-            mainHistory->m_currentUserGestureObjectsAdded = 0;
-        }
-
-        if (mainHistory->m_currentUserGestureObjectsAdded >= perUserGestureStateObjectLimit) {
-            ec.code = SECURITY_ERR;
-            if (stateObjectType == StateObjectType::Replace)
-                ec.message = String::format("Attempt to use history.replaceState() more than %u times per gesture", perUserGestureStateObjectLimit);
-            else
-                ec.message = String::format("Attempt to use history.pushState() more than %u times per user gesture", perUserGestureStateObjectLimit);
-            return;
-        }
-    }
-
     Checked<unsigned> titleSize = title.length();
     titleSize *= 2;
 
@@ -216,10 +205,7 @@ void History::stateObjectAdded(PassRefPtr<SerializedScriptValue> data, const Str
     m_mostRecentStateObjectUsage = payloadSize.unsafeGet();
 
     mainHistory->m_totalStateObjectUsage = newTotalUsage.unsafeGet();
-    if (processingUserGesture)
-        ++mainHistory->m_currentUserGestureObjectsAdded;
-    else
-        ++mainHistory->m_nonUserGestureObjectsAdded;
+    ++mainHistory->m_currentStateObjectTimeSpanObjectsAdded;
 
     if (!urlString.isEmpty())
         m_frame->document()->updateURLForPushOrReplaceState(fullURL);
index 713432d..b3f9d1f 100644 (file)
@@ -73,9 +73,8 @@ private:
 
     RefPtr<SerializedScriptValue> m_lastStateObjectRequested;
 
-    unsigned m_nonUserGestureObjectsAdded { 0 };
-    unsigned m_currentUserGestureObjectsAdded { 0 };
-    double m_currentUserGestureTimestamp { 0 };
+    unsigned m_currentStateObjectTimeSpanObjectsAdded { 0 };
+    double m_currentStateObjectTimeSpanStart { 0.0 };
 
     // For the main frame's History object to keep track of all state object usage.
     uint64_t m_totalStateObjectUsage { 0 };