Bug 145328 – Document::ensurePlugInsInjectedScript() should evaluate the injected script on its own frame

• Component: WebCore Misc.
• Status: RESOLVED FIXED

[Mark Lam]

HTMLPlugInImageElement::didAddUserAgentShadowRoot() calls into the JSC VM to get the "createOverlay" function.  If an exception occurs in this call, it should handle that exception.  Currently, it does, and leaves a dangling exception in the VM.

[Mark Lam]

The exception was because we couldn't find a createOverlay property in the global object, and we tried to convert the returned undefined to an object.  However, it turns out that createOverlay should never be undefined.

So, the real bug is why is the property coming back as undefined.

[Mark Lam]

http://trac.webkit.org/changeset/184329 fixed HTMLPlugInImageElement::didAddUserAgentShadowRoot() to use the document's frame instead of the page's main frame.  However, Document::ensurePlugInsInjectedScript() is still evaluating the injected script on the main frame.

As a result, HTMLPlugInImageElement::didAddUserAgentShadowRoot()'s attempt to get the createOverlay function from the document frame's global object will fail.  Fixing Document::ensurePlugInsInjectedScript() to evaluating the injected script on the document's frame fixes the issue.

[Mark Lam]

http://trac.webkit.org/changeset/184329 fixed HTMLPlugInImageElement::didAddUserAgentShadowRoot() to use the document's frame instead of the page's main frame.  However, Document::ensurePlugInsInjectedScript() is still evaluating the injected script on the main frame.

As a result, HTMLPlugInImageElement::didAddUserAgentShadowRoot()'s attempt to get the createOverlay function from the document frame's global object will fail.  Fixing Document::ensurePlugInsInjectedScript() to evaluating the injected script on the document's frame fixes the issue.

[Mark Lam]

Created attachment 253626 [details]
the patch.

[Jon Lee]

Comment on attachment 253626 [details]
the patch.

Provisional r=me

[Mark Lam]

Comment on attachment 253626 [details]
the patch.

Bots are all green.  Jon already r+'ed.  Will land.

[Mark Lam]

Thanks for the review.  Landed in r184816: <http://trac.webkit.org/r184816>.

[Geoffrey Garen]

Comment on attachment 253626 [details]
the patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=253626&action=review

> Source/WebCore/ChangeLog:18
> +        No new tests.

Why not?