Bug 48970 – User scripts shouldn't be injected in a frame's empty initial document

• Component: WebCore Misc.
• Status: RESOLVED FIXED

[Brian Weinstein]

When a frame loads, it first creates an empty initial document, then navigates to the correct URL. In WebKit2, the timing is slightly different than WebKit1, so when a new window or tab is created, start scripts are injected into the frame when it is about:blank, and then when it navigates to the correct URL.

This also happens when you inject scripts into all frames, iframes will look like they have had scripts injected twice - once with the URL being about:blank, and the other with the URL being the final URL of the frame. This is confusing to extension developers, and we shouldn't inject the scripts into the empty initial about:blank document.

<rdar://problem/8082122>
<rdar://problem/8618164>

[Brian Weinstein]

Created attachment 72900 [details]
[PATCH] Fix

[Alexey Proskuryakov]

User scripts will still be injected into about:blank, correct?

[Brian Weinstein]

(In reply to comment #2)
> User scripts will still be injected into about:blank, correct?

Yes - userscripts/script-run-at-start.html tests that scripts are injected into about:blank.

[Brian Weinstein]

Landed in r71339.

[Timothy Hatcher]

Comment on attachment 72900 [details]
[PATCH] Fix

View in context: https://bugs.webkit.org/attachment.cgi?id=72900&action=review

> WebCore/ChangeLog:10
> +        When a frame loads, it first creates an empty initial document, then navigates to the correct URL. Our

So <iframe src="about:blank"> will still work and get the content scripts once?

> WebCore/ChangeLog:15
> +        issue between WebKit1 and WebKit2 that causes start scripts to be injected into the initial empty document

Do we know what caused the timing issue between WK1 and WK2? Will that timing issue show up in other areas too?

[Brian Weinstein]

(In reply to comment #5)
> (From update of attachment 72900 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=72900&action=review
> 
> > WebCore/ChangeLog:10
> > +        When a frame loads, it first creates an empty initial document, then navigates to the correct URL. Our
> 
> So <iframe src="about:blank"> will still work and get the content scripts once?

Yes - it will get end scripts once, and start scripts once. We have a test for this in the WebKit tree. userscripts/script-run-at-start.html tests that start scripts are injected into about:blank.

> 
> > WebCore/ChangeLog:15
> > +        issue between WebKit1 and WebKit2 that causes start scripts to be injected into the initial empty document
> 
> Do we know what caused the timing issue between WK1 and WK2? Will that timing issue show up in other areas too?

I haven't seen it come up in other areas - we believe it was a timing issue with the IPC - either the app was sending the user scripts across the wire earlier, or the web process was starting and loading the page later, and by that point the user scripts list wasn't empty.

[Andy Estes]

What about apps that create a frame and then add nodes to the initial document using DOM API? We should be able to inject scripts into these documents, no?

I actually would like to use an injected script in this manner to fix <https://bugs.webkit.org/show_bug.cgi?id=57794>.