Attachment #76713 for bug #50254

View Details Raw Unified Return to Bug 50254

| Differences between



2010-12-15  Charlie Reis  <creis@chromium.org>

        Reviewed by NOBODY (OOPS!).

        Canceled frame loads can corrupt back forward list
        https://bugs.webkit.org/show_bug.cgi?id=50254

        Resets top-level history items if a subframe navigation is canceled.

        * WebCore/loader/FrameLoader.cpp:
        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
        * WebCore/loader/HistoryController.cpp:
        * WebCore/loader/HistoryController.h:

2010-12-15  Simon Fraser  <simon.fraser@apple.com>

        Reviewed by Chris Marrin.




            // Check all children first.
            RefPtr<HistoryItem> item;
            if (Page* page = m_frame->page()) {
                if (isBackForwardLoadType(loadType())) {
                    if (m_frame == page->mainFrame()) {
                        // We need to reset the back forward list to the last committed
                        // history item.
                        item = history()->currentItem();
                    } else {
                        // We need to reset the back forward list to the corresponding
                        // top-level history item, which is currently the main frame's
                        // previous item (because recursiveGoToItem has set the current
                        // item already).
                        item = page->mainFrame()->loader()->history()->previousItem();
                    }
                }
            }
                
            bool shouldReset = true;
            if (!(pdl->isLoadingInAPISense() && !pdl->isStopping())) {

                    page->backForward()->setCurrentItem(item.get());
                    Settings* settings = m_frame->settings();
                    page->setGlobalHistoryItem((!settings || settings->privateBrowsingEnabled()) ? 0 : item.get());

                    // If this is a subframe, we have also modified the top-level history's
                    // current item in recursiveGoToItem, and we need to reset it.
                    if (m_frame != page->mainFrame())
                        page->mainFrame()->loader()->history()->cancelCurrentItem();
                }
            return;
        }

Lines 448-453 bool HistoryController::currentItemShoul WebCore/loader/HistoryController.cpp_sec1
- WebCore/loader/HistoryController.cpp +5 lines
448	return m_currentItem && !m_previousItem && equalIgnoringCase(m_currentItem->urlString(), blankURL());	448	return m_currentItem && !m_previousItem && equalIgnoringCase(m_currentItem->urlString(), blankURL());
449	}	449	}
450		450
		451	void HistoryController::cancelCurrentItem()
		452	{
		453	m_currentItem = m_previousItem;
		454	}
		455
451	void HistoryController::setProvisionalItem(HistoryItem* item)	456	void HistoryController::setProvisionalItem(HistoryItem* item)
452	{	457	{
453	m_provisionalItem = item;	458	m_provisionalItem = item;

Lines 74-79 public: WebCore/loader/HistoryController.h_sec1
- WebCore/loader/HistoryController.h +1 lines
74	void setCurrentItem(HistoryItem*);	74	void setCurrentItem(HistoryItem*);
75	void setCurrentItemTitle(const String&);	75	void setCurrentItemTitle(const String&);
76	bool currentItemShouldBeReplaced() const;	76	bool currentItemShouldBeReplaced() const;
		77	void cancelCurrentItem();
77		78
78	HistoryItem* previousItem() const { return m_previousItem.get(); }	79	HistoryItem* previousItem() const { return m_previousItem.get(); }
79		80



2010-12-15  Charlie Reis  <creis@chromium.org>

        Reviewed by NOBODY (OOPS!).

        Canceled frame loads can corrupt back forward list
        https://bugs.webkit.org/show_bug.cgi?id=50254

        http/tests/navigation/forward-and-cancel.html aborts a slowly loading
        frame and ensures the history items are updated properly.

        * LayoutTests/http/tests/navigation/forward-and-cancel-expected.txt: Added.
        * LayoutTests/http/tests/navigation/forward-and-cancel.html: Added.
        * LayoutTests/http/tests/navigation/resources/forward-and-cancel-frames.html: Added.

2010-12-15  Mihai Parparita  <mihaip@chromium.org>

        Reviewed by Eric Seidel.



This test checks that the backForward list is not corrupted when a frame load is canceled.

If testing manually, click here.

============== Back Forward List ==============
curr->  http://127.0.0.1:8000/navigation/forward-and-cancel.html  **nav target**
        http://127.0.0.1:8000/navigation/resources/forward-and-cancel-frames.html  **nav target**
            about:blank (in frame "frame1")
        http://127.0.0.1:8000/navigation/resources/forward-and-cancel-frames.html
            http://127.0.0.1:8000/navigation/resources/slow-resource-1-sec.pl (in frame "frame1")  **nav target**
===============================================



<script>
if (window.layoutTestController) {
    layoutTestController.dumpBackForwardList();
    layoutTestController.dumpAsText();
    layoutTestController.queueLoad("resources/forward-and-cancel-frames.html");
    layoutTestController.queueLoad("javascript:clickLink();");
    layoutTestController.queueBackNavigation(1);

    // Go forward to slow frame, but stop right away.  This should reset the
    // backForward list to the previous entry.
    layoutTestController.queueNonLoadingScript("setTimeout('history.forward();',0); setTimeout('window.stop();',10);");

    // Now go back to make sure the backForwardList is not corrupted.
    layoutTestController.queueNonLoadingScript("setTimeout('history.back();',50);");

    // Wait until we get back to this page.
    layoutTestController.queueLoadingScript("layoutTestController.waitUntilDone();");
}
</script>
<p>This test checks that the backForward list is not corrupted when a frame load is canceled.
<p>If testing manually, <a href="resources/forward-and-cancel-frames.html">click here</a>.

<script>
if (window.layoutTestController) {
    // This only has an effect when we return to this page at the end of the test.
    layoutTestController.notifyDone();
}
</script>



<script>
function clickLink() {
  // Simulate a mouse click on a link targeting the frame.
  var evt = document.createEvent("MouseEvents");
  evt.initMouseEvent("click", true, true, window,
      0, 0, 0, 0, 0, false, false, false, false, 0, null);
  document.getElementById("link").dispatchEvent(evt);
}
</script>
<iframe id="frame1" src="about:blank"></iframe>
<br>
<p>This test checks that the backForward list is not corrupted when a frame load is canceled.
<p>If testing manually, <a id="link" href="slow-resource-1-sec.pl" target="frame1">click here</a> and then Back.  Then click Forward and quickly click Stop.  Ensure that Back and Forward still work.

Return to Bug 50254

Lines 2336-2344 void FrameLoader::checkLoadCompleteForTh WebCore/loader/FrameLoader.cpp_sec1
- WebCore/loader/FrameLoader.cpp -3 / +20 lines
2336		2336
2337	// Check all children first.	2337	// Check all children first.
2338	RefPtr<HistoryItem> item;	2338	RefPtr<HistoryItem> item;
2339	if (Page* page = m_frame->page())	2339	if (Page* page = m_frame->page()) {
2340	if (isBackForwardLoadType(loadType()) && m_frame == page->mainFrame())	2340	if (isBackForwardLoadType(loadType())) {
2341	item = history()->currentItem();	2341	if (m_frame == page->mainFrame()) {
		2342	// We need to reset the back forward list to the last committed
		2343	// history item.
		2344	item = history()->currentItem();
		2345	} else {
		2346	// We need to reset the back forward list to the corresponding
		2347	// top-level history item, which is currently the main frame's
		2348	// previous item (because recursiveGoToItem has set the current
		2349	// item already).
		2350	item = page->mainFrame()->loader()->history()->previousItem();
		2351	}
		2352	}
		2353	}
2342		2354
2343	bool shouldReset = true;	2355	bool shouldReset = true;
2344	if (!(pdl->isLoadingInAPISense() && !pdl->isStopping())) {	2356	if (!(pdl->isLoadingInAPISense() && !pdl->isStopping())) {
Lines 2371-2376 void FrameLoader::checkLoadCompleteForTh WebCore/loader/FrameLoader.cpp_sec2
2371	page->backForward()->setCurrentItem(item.get());	2383	page->backForward()->setCurrentItem(item.get());
2372	Settings* settings = m_frame->settings();	2384	Settings* settings = m_frame->settings();
2373	page->setGlobalHistoryItem((!settings \|\| settings->privateBrowsingEnabled()) ? 0 : item.get());	2385	page->setGlobalHistoryItem((!settings \|\| settings->privateBrowsingEnabled()) ? 0 : item.get());
		2386
		2387	// If this is a subframe, we have also modified the top-level history's
		2388	// current item in recursiveGoToItem, and we need to reset it.
		2389	if (m_frame != page->mainFrame())
		2390	page->mainFrame()->loader()->history()->cancelCurrentItem();
2374	}	2391	}
2375	return;	2392	return;
2376	}	2393	}

Lines 1-3 WebCore/ChangeLog_sec1
- WebCore/ChangeLog +14 lines
		1	2010-12-15 Charlie Reis <creis@chromium.org>
		2
		3	Reviewed by NOBODY (OOPS!).
		4
		5	Canceled frame loads can corrupt back forward list
		6	https://bugs.webkit.org/show_bug.cgi?id=50254
		7
		8	Resets top-level history items if a subframe navigation is canceled.
		9
		10	* WebCore/loader/FrameLoader.cpp:
		11	(WebCore::FrameLoader::checkLoadCompleteForThisFrame):
		12	* WebCore/loader/HistoryController.cpp:
		13	* WebCore/loader/HistoryController.h:
		14
1	2010-12-15 Simon Fraser <simon.fraser@apple.com>	15	2010-12-15 Simon Fraser <simon.fraser@apple.com>
2		16
3	Reviewed by Chris Marrin.	17	Reviewed by Chris Marrin.

Lines 1-3 LayoutTests/ChangeLog_sec1
- LayoutTests/ChangeLog +14 lines
		1	2010-12-15 Charlie Reis <creis@chromium.org>
		2
		3	Reviewed by NOBODY (OOPS!).
		4
		5	Canceled frame loads can corrupt back forward list
		6	https://bugs.webkit.org/show_bug.cgi?id=50254
		7
		8	http/tests/navigation/forward-and-cancel.html aborts a slowly loading
		9	frame and ensures the history items are updated properly.
		10
		11	* LayoutTests/http/tests/navigation/forward-and-cancel-expected.txt: Added.
		12	* LayoutTests/http/tests/navigation/forward-and-cancel.html: Added.
		13	* LayoutTests/http/tests/navigation/resources/forward-and-cancel-frames.html: Added.
		14
1	2010-12-15 Mihai Parparita <mihaip@chromium.org>	15	2010-12-15 Mihai Parparita <mihaip@chromium.org>
2		16
3	Reviewed by Eric Seidel.	17	Reviewed by Eric Seidel.

Line 0 LayoutTests/http/tests/navigation/forward-and-cancel-expected.txt_sec1
- LayoutTests/http/tests/navigation/forward-and-cancel-expected.txt +11 lines
	1	This test checks that the backForward list is not corrupted when a frame load is canceled.
	2
	3	If testing manually, click here.
	4
	5	============== Back Forward List ==============
	6	curr-> http://127.0.0.1:8000/navigation/forward-and-cancel.html nav target
	7	http://127.0.0.1:8000/navigation/resources/forward-and-cancel-frames.html nav target
	8	about:blank (in frame "frame1")
	9	http://127.0.0.1:8000/navigation/resources/forward-and-cancel-frames.html
	10	http://127.0.0.1:8000/navigation/resources/slow-resource-1-sec.pl (in frame "frame1") nav target
	11	===============================================

Line 0 LayoutTests/http/tests/navigation/forward-and-cancel.html_sec1
- LayoutTests/http/tests/navigation/forward-and-cancel.html +28 lines
	1	<script>
	2	if (window.layoutTestController) {
	3	layoutTestController.dumpBackForwardList();
	4	layoutTestController.dumpAsText();
	5	layoutTestController.queueLoad("resources/forward-and-cancel-frames.html");
	6	layoutTestController.queueLoad("javascript:clickLink();");
	7	layoutTestController.queueBackNavigation(1);
	8
	9	// Go forward to slow frame, but stop right away. This should reset the
	10	// backForward list to the previous entry.
	11	layoutTestController.queueNonLoadingScript("setTimeout('history.forward();',0); setTimeout('window.stop();',10);");
	12
	13	// Now go back to make sure the backForwardList is not corrupted.
	14	layoutTestController.queueNonLoadingScript("setTimeout('history.back();',50);");
	15
	16	// Wait until we get back to this page.
	17	layoutTestController.queueLoadingScript("layoutTestController.waitUntilDone();");
	18	}
	19	</script>
	20	<p>This test checks that the backForward list is not corrupted when a frame load is canceled.
	21	<p>If testing manually, <a href="resources/forward-and-cancel-frames.html">click here</a>.
	22
	23	<script>
	24	if (window.layoutTestController) {
	25	// This only has an effect when we return to this page at the end of the test.
	26	layoutTestController.notifyDone();
	27	}
	28	</script>

Line 0 LayoutTests/http/tests/navigation/resources/forward-and-cancel-frames.html_sec1
- LayoutTests/http/tests/navigation/resources/forward-and-cancel-frames.html +13 lines
	1	<script>
	2	function clickLink() {
	3	// Simulate a mouse click on a link targeting the frame.
	4	var evt = document.createEvent("MouseEvents");
	5	evt.initMouseEvent("click", true, true, window,
	6	0, 0, 0, 0, 0, false, false, false, false, 0, null);
	7	document.getElementById("link").dispatchEvent(evt);
	8	}
	9	</script>
	10	<iframe id="frame1" src="about:blank"></iframe>
	11	<br>
	12	<p>This test checks that the backForward list is not corrupted when a frame load is canceled.
	13	<p>If testing manually, <a id="link" href="slow-resource-1-sec.pl" target="frame1">click here</a> and then Back. Then click Forward and quickly click Stop. Ensure that Back and Forward still work.