Bug 181505 - Setting Window.opener to null should disown its opener
Summary: Setting Window.opener to null should disown its opener
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: DOM (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Chris Dumez
URL: https://html.spec.whatwg.org/#dom-opener
Keywords: InRadar
Depends on:
Blocks: 181634
  Show dependency treegraph
 
Reported: 2018-01-10 16:34 PST by Chris Dumez
Modified: 2018-02-05 11:56 PST (History)
12 users (show)

See Also:


Attachments
WIP Patch (2.65 KB, patch)
2018-01-10 17:02 PST, Chris Dumez
no flags Details | Formatted Diff | Diff
Archive of layout-test-results from ews106 for mac-sierra-wk2 (2.73 MB, application/zip)
2018-01-10 21:42 PST, EWS Watchlist
no flags Details
Patch (9.10 KB, patch)
2018-01-11 10:53 PST, Chris Dumez
no flags Details | Formatted Diff | Diff
Archive of layout-test-results from ews112 for mac-sierra (3.02 MB, application/zip)
2018-01-11 12:33 PST, EWS Watchlist
no flags Details
Patch (9.22 KB, patch)
2018-01-11 12:40 PST, Chris Dumez
no flags Details | Formatted Diff | Diff
Patch (9.18 KB, patch)
2018-01-11 19:56 PST, Chris Dumez
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Dumez 2018-01-10 16:34:45 PST
Setting Window.opener to null to disown the window's opener:
- https://html.spec.whatwg.org/#dom-opener

This seems to be impacting Gmail.
Comment 1 Chris Dumez 2018-01-10 17:02:31 PST
Created attachment 330990 [details]
WIP Patch
Comment 2 Chris Dumez 2018-01-10 17:02:57 PST
Will work on a test tomorrow.
Comment 3 EWS Watchlist 2018-01-10 21:42:55 PST
Comment on attachment 330990 [details]
WIP Patch

Attachment 330990 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.webkit.org/results/6029767

New failing tests:
webgl/1.0.2/conformance/uniforms/uniform-default-values.html
Comment 4 EWS Watchlist 2018-01-10 21:42:57 PST
Created attachment 331026 [details]
Archive of layout-test-results from ews106 for mac-sierra-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews106  Port: mac-sierra-wk2  Platform: Mac OS X 10.12.6
Comment 5 Chris Dumez 2018-01-11 10:17:35 PST
Comment on attachment 331026 [details]
Archive of layout-test-results from ews106 for mac-sierra-wk2

Not related.
Comment 6 Radar WebKit Bug Importer 2018-01-11 10:50:44 PST
<rdar://problem/36443151>
Comment 7 Chris Dumez 2018-01-11 10:53:04 PST
Created attachment 331074 [details]
Patch
Comment 8 John Wilander 2018-01-11 11:03:09 PST
Looks good to me. This was the thing I think Mike West was talking about — disowning the opener.
Comment 9 John Wilander 2018-01-11 11:05:29 PST
Is there a way to test that disowning the opener makes WebKit not keep the pages in the same web process?
Comment 10 Chris Dumez 2018-01-11 12:10:30 PST
(In reply to John Wilander from comment #9)
> Is there a way to test that disowning the opener makes WebKit not keep the
> pages in the same web process?

Well, but it does currently :P
Comment 11 Chris Dumez 2018-01-11 12:10:50 PST
(In reply to Chris Dumez from comment #10)
> (In reply to John Wilander from comment #9)
> > Is there a way to test that disowning the opener makes WebKit not keep the
> > pages in the same web process?
> 
> Well, but it does currently :P

That's another issue we have to fix.
Comment 12 EWS Watchlist 2018-01-11 12:33:20 PST
Comment on attachment 331074 [details]
Patch

Attachment 331074 [details] did not pass mac-debug-ews (mac):
Output: http://webkit-queues.webkit.org/results/6037592

New failing tests:
fast/dom/Window/window-opener-set-to-null.html
Comment 13 EWS Watchlist 2018-01-11 12:33:21 PST
Created attachment 331096 [details]
Archive of layout-test-results from ews112 for mac-sierra

The attached test failures were seen while running run-webkit-tests on the mac-debug-ews.
Bot: ews112  Port: mac-sierra  Platform: Mac OS X 10.12.6
Comment 14 Chris Dumez 2018-01-11 12:40:01 PST
Created attachment 331098 [details]
Patch
Comment 15 Ryosuke Niwa 2018-01-11 16:45:40 PST
Comment on attachment 331098 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=331098&action=review

> Source/WebCore/bindings/js/JSDOMWindowCustom.cpp:478
> +    replaceStaticPropertySlot(state.vm(), this, Identifier::fromString(&state.vm(), reinterpret_cast<const LChar*>("opener"), strlen("opener")), value);

Why not just Identifier::fromString(&state.vm(), "opener")?
Comment 16 Chris Dumez 2018-01-11 16:46:33 PST
Comment on attachment 331098 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=331098&action=review

>> Source/WebCore/bindings/js/JSDOMWindowCustom.cpp:478
>> +    replaceStaticPropertySlot(state.vm(), this, Identifier::fromString(&state.vm(), reinterpret_cast<const LChar*>("opener"), strlen("opener")), value);
> 
> Why not just Identifier::fromString(&state.vm(), "opener")?

Hmm, I copy/pasted the code from the bindings generator. I'll look into it so see if there is a good reason.
Comment 17 Chris Dumez 2018-01-11 19:56:41 PST
Created attachment 331161 [details]
Patch
Comment 18 WebKit Commit Bot 2018-01-11 20:47:35 PST
Comment on attachment 331161 [details]
Patch

Clearing flags on attachment: 331161

Committed r226842: <https://trac.webkit.org/changeset/226842>
Comment 19 WebKit Commit Bot 2018-01-11 20:47:37 PST
All reviewed patches have been landed.  Closing bug.
Comment 20 Darin Adler 2018-01-13 12:38:56 PST
Comment on attachment 331161 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=331161&action=review

> Source/WebCore/bindings/js/JSDOMWindowCustom.cpp:478
> +    if (value.isNull()) {
> +        wrapped().disownOpener();
> +        return;
> +    }
> +    replaceStaticPropertySlot(state.vm(), this, Identifier::fromString(&state.vm(), "opener"), value);

I don’t see test coverage for the case where we first have opener reflecting the real opening, then set it to "foo" and then set it to null. Will this do the right thing in that case, or will "foo" still be left behind in the static property slot?
Comment 21 Chris Dumez 2018-01-13 19:55:09 PST
(In reply to Darin Adler from comment #20)
> Comment on attachment 331161 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=331161&action=review
> 
> > Source/WebCore/bindings/js/JSDOMWindowCustom.cpp:478
> > +    if (value.isNull()) {
> > +        wrapped().disownOpener();
> > +        return;
> > +    }
> > +    replaceStaticPropertySlot(state.vm(), this, Identifier::fromString(&state.vm(), "opener"), value);
> 
> I don’t see test coverage for the case where we first have opener reflecting
> the real opening, then set it to "foo" and then set it to null. Will this do
> the right thing in that case, or will "foo" still be left behind in the
> static property slot?

I will add testing and check other browsers. My current implementation would disown the opener and keep "foo" expando property. This seems correct to me based on my interpretation of the specification:
"""
On setting, if the new value is null then the current browsing context must disown its opener; if the new value is anything else then the user agent must call the [[DefineOwnProperty]] internal method of the Window object, passing the property name "opener" as the property key, and the Property Descriptor { [[Value]]: value, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true } as the property descriptor, where value is the new value.
"""
Comment 22 Chris Dumez 2018-01-13 20:04:50 PST
(In reply to Chris Dumez from comment #21)
> (In reply to Darin Adler from comment #20)
> > Comment on attachment 331161 [details]
> > Patch
> > 
> > View in context:
> > https://bugs.webkit.org/attachment.cgi?id=331161&action=review
> > 
> > > Source/WebCore/bindings/js/JSDOMWindowCustom.cpp:478
> > > +    if (value.isNull()) {
> > > +        wrapped().disownOpener();
> > > +        return;
> > > +    }
> > > +    replaceStaticPropertySlot(state.vm(), this, Identifier::fromString(&state.vm(), "opener"), value);
> > 
> > I don’t see test coverage for the case where we first have opener reflecting
> > the real opening, then set it to "foo" and then set it to null. Will this do
> > the right thing in that case, or will "foo" still be left behind in the
> > static property slot?
> 
> I will add testing and check other browsers. My current implementation would
> disown the opener and keep "foo" expando property. This seems correct to me
> based on my interpretation of the specification:
> """
> On setting, if the new value is null then the current browsing context must
> disown its opener; if the new value is anything else then the user agent
> must call the [[DefineOwnProperty]] internal method of the Window object,
> passing the property name "opener" as the property key, and the Property
> Descriptor { [[Value]]: value, [[Writable]]: true, [[Enumerable]]: true,
> [[Configurable]]: true } as the property descriptor, where value is the new
> value.
> """

Firefox and chrome seem to return null and not "foo" which means we are not interoperable unfortunately. I filed a bug against the spec (https://github.com/whatwg/html/issues/3351) and will align WebKit with other browser engines.
Comment 23 Chris Dumez 2018-01-13 21:12:06 PST
(In reply to Chris Dumez from comment #22)
> (In reply to Chris Dumez from comment #21)
> > (In reply to Darin Adler from comment #20)
> > > Comment on attachment 331161 [details]
> > > Patch
> > > 
> > > View in context:
> > > https://bugs.webkit.org/attachment.cgi?id=331161&action=review
> > > 
> > > > Source/WebCore/bindings/js/JSDOMWindowCustom.cpp:478
> > > > +    if (value.isNull()) {
> > > > +        wrapped().disownOpener();
> > > > +        return;
> > > > +    }
> > > > +    replaceStaticPropertySlot(state.vm(), this, Identifier::fromString(&state.vm(), "opener"), value);
> > > 
> > > I don’t see test coverage for the case where we first have opener reflecting
> > > the real opening, then set it to "foo" and then set it to null. Will this do
> > > the right thing in that case, or will "foo" still be left behind in the
> > > static property slot?
> > 
> > I will add testing and check other browsers. My current implementation would
> > disown the opener and keep "foo" expando property. This seems correct to me
> > based on my interpretation of the specification:
> > """
> > On setting, if the new value is null then the current browsing context must
> > disown its opener; if the new value is anything else then the user agent
> > must call the [[DefineOwnProperty]] internal method of the Window object,
> > passing the property name "opener" as the property key, and the Property
> > Descriptor { [[Value]]: value, [[Writable]]: true, [[Enumerable]]: true,
> > [[Configurable]]: true } as the property descriptor, where value is the new
> > value.
> > """
> 
> Firefox and chrome seem to return null and not "foo" which means we are not
> interoperable unfortunately. I filed a bug against the spec
> (https://github.com/whatwg/html/issues/3351) and will align WebKit with
> other browser engines.

As it turns out, the spec and our implementation is correct. I am extending testing via Bug 181634. When you set it to "foo", it calls [DefineOwnProperty] which overrides our "native" property. When you then set to null, it merely updates the descriptor's value to null, it does not call our native setter.