Bug 31067 – Chromium crashes when a plugin invokes the document.open function via NPAPI

• Status: RESOLVED
• Resolution: FIXED
• Component: WebCore JavaScript

[Ananta Iyengar]

This is a chromium only issue.
If a plugin invokes the document.open function on the document object via the NPN_Invoke function 
then the chrome renderer process crashes.

The crash occurs in the V8 bindings code.

The associated chromium bug is http://code.google.com/p/chromium/issues/detail?id=25703

I will submit a patch for this.

[Ananta Iyengar]

This crash occurs if the plugin invokes the NPN_Invoke API to open a document via document.open without an associated javascript context.

If the NPN_Invoke API is used to open a popup via window.open, it fails as well in Chromium.

[Ananta Iyengar]

Created attachment 42435 [details]
Initial patch with layout tests.

[Adam Barth]

Comment on attachment 42435 [details]
Initial patch with layout tests.

This looks great.  A couple minor issues:

 123     if (frame)
 124         htmlDocument->write(writeHelperGetString(args), frame->document());

We can call htmlDocument->write even when |frame| is null.  We can just pass a null second argument.

In your LayoutTest/ChangeLog, you have several copies of the change description.

[Ananta Iyengar]

Created attachment 42538 [details]
Updated patch based on initial review comments

[Ananta Iyengar]

Created attachment 42586 [details]
Updated patch which now passes layout test runs on mac and windows.

[Ananta Iyengar]

Created attachment 42669 [details]
Updated patch with the document.open invocation from the plugin now done in npp_destroystream

[Adam Barth]

Comment on attachment 42669 [details]
Updated patch with the document.open invocation from the plugin now done in npp_destroystream

This looks great.  One typo:

 132     if (frame)
 133         htmlDocument->writeln(writeHelperGetString(args), frame ? frame->document() : NULL);

We don't want the "if (frame)" here.  I can either fix this you on landing or we can use commit-queue if you upload a new patch.

[Adam Barth]

Created attachment 42672 [details]
Patch

[WebKit Commit Bot]

Comment on attachment 42672 [details]
Patch

Clearing flags on attachment: 42672

Committed r50607: <http://trac.webkit.org/changeset/50607>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Kenneth Rohde Christiansen]

Hi guys,

Running plugins/window-open.html with Qt WebKit does not open any window. Can you give me any hints on where to look in the code base for fixing this?

It basically calls invoke which uses a cross platform implementation. Our DRT also supports opening windows.