Bug 223791

Summary: embed element with the src attribute set prevents WebKitTestRunner from exiting
Product: WebKit Reporter: Ryosuke Niwa <rniwa>
Component: Tools / TestsAssignee: Nobody <webkit-unassigned>
Severity: Normal CC: ap, bfulgham, cdumez, cgarcia, changseok, darin, esprehn+autocc, ews-watchlist, fred.wang, gpoo, gyuyoung.kim, product-security, rbuis, svillar, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Description Flags
Patch none

Description Ryosuke Niwa 2021-03-26 03:18:40 PDT
WebKitTestRunner does not proceed after loading this:

  onload = () => {
    let e = document.createElement('embed');
    e.src = 'x';

Comment 1 Darin Adler 2021-03-26 10:27:17 PDT
Seems like this is an impediment to fuzz testing, not a bug that itself has security impact, right?
Comment 2 Ryosuke Niwa 2021-03-27 03:50:02 PDT
(In reply to Darin Adler from comment #1)
> Seems like this is an impediment to fuzz testing, not a bug that itself has
> security impact, right?

Yeah, I guess there is no need to keep this under security component.
Comment 3 Carlos Garcia Campos 2021-04-21 03:13:50 PDT
The problem is that the load never finishes, so WTR keeps waiting for the final message from injected bundle that happens when the page is loaded. When the src attribute is changed, HTMLPlugInImageElement::updateImageLoaderWithNewURLSoon() is called. That calls HTMLPlugInImageElement::scheduleUpdateForAfterStyleResolution() that increases the document load event delay count and queues a style post resolution callback. The document load event delay count is decreased in HTMLPlugInImageElement::updateAfterStyleResolution), called by the style post resolution callback. But the callback is never called because the embed element is not in tree, and it's never added, keeping the document load event delay unbalanced. I think we should not call scheduleUpdateForAfterStyleResolution() when the element is not in render tree, since we know Node::invalidateStyle() will return early and style post resolution callbacks will not be called. If the element is added to the tree eventually, scheduleUpdateForAfterStyleResolution() will be called by didRecalcStyle, so the image will be loaded.
Comment 4 Carlos Garcia Campos 2021-04-21 04:07:37 PDT
Created attachment 426669 [details]
Comment 5 Ryosuke Niwa 2021-04-23 23:10:09 PDT
Comment on attachment 426669 [details]

Comment 6 EWS 2021-04-26 01:21:40 PDT
Committed r276582 (237018@main): <https://commits.webkit.org/237018@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 426669 [details].