haikuwebkit/LayoutTests/fast/events/event-handler-detached-docu...

31 lines
1.0 KiB
HTML
Raw Permalink Normal View History

Event handlers should not be called in frameless documents https://bugs.webkit.org/show_bug.cgi?id=173233 Reviewed by Sam Weinig. LayoutTests/imported/w3c: Rebaseline W3C test now that it is passing. * web-platform-tests/html/webappapis/scripting/events/uncompiled_event_handler_with_scripting_disabled-expected.txt: Source/WebCore: As per the HTML specification [1], for event handlers on elements, we should use the element's document to check if scripting is disabled [2]. Scripting is considered to be disabled if the document has no browsing context (i.e. a frame in WebKit terms). In JSLazyEventListener::initializeJSFunction(), instead of using the element's document to do the checks, we would use the script execution context. In most cases, a node's document and its script execution context are the same so this is not an issue. However, if the node's document is a document created via JS, its nodes' script execution context will be the document's context document (i.e the one that created the document, see implementation of Node::scriptExecutionContext()). In those cases, using the wrong document is an issue because the document's context document (aka script execution context) may allow scripting but we still do not want to call the event handler because its document is frameless. This impacts documents created by JS, using the following APIs: - DOMParser.parseFromHTML - new Document() - DOMImplementation.createDocument / createHTMLDocument - XHRs whose responseType is Document. [1] https://html.spec.whatwg.org/multipage/webappapis.html#getting-the-current-value-of-the-event-handler (step 1.1.) [2] https://html.spec.whatwg.org/multipage/webappapis.html#concept-n-noscript Tests: fast/events/event-handler-detached-document-dispatchEvent.html fast/events/event-handler-detached-document.html * bindings/js/JSLazyEventListener.cpp: (WebCore::JSLazyEventListener::initializeJSFunction): LayoutTests: Extend layout test coverage. * fast/events/event-handler-detached-document-dispatchEvent-expected.txt: Added. * fast/events/event-handler-detached-document-dispatchEvent.html: Added. * fast/events/event-handler-detached-document-expected.txt: Added. * fast/events/event-handler-detached-document.html: Added. Canonical link: https://commits.webkit.org/190218@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@218242 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2017-06-14 03:48:23 +00:00
<!DOCTYPE html>
<html>
<body>
<script src="../../resources/js-test.js"></script>
<script>
description("Tests that event handlers are not called in detached documents, even if the event is dispatched by JavaScript. This test passes if you do not see a FAIL alert message.");
jsTestIsAsync = true;
let doc = new DOMParser().parseFromString('<video src=x onerror=alert("FAIL1")>','text/html');
let video = doc.body.firstChild;
shouldBe("video.__proto__", "HTMLVideoElement.prototype");
video.dispatchEvent(new CustomEvent("error"));
doc = new DOMParser().parseFromString('<video onerror=alert(event.expected)>','text/html');
video = doc.body.firstChild;
shouldBe("video.__proto__", "HTMLVideoElement.prototype");
let failEvent = new CustomEvent("error");
failEvent.expected = "FAIL";
video.dispatchEvent(failEvent);
debug("Adopting node into a document that has a frame");
document.adoptNode(video);
let passEvent = new CustomEvent("error");
passEvent.expected = "PASS";
video.dispatchEvent(passEvent);
setTimeout(finishJSTest, 0);
</script>
</body>
</html>