Title: [233793] trunk/Source/WebCore
- Revision
- 233793
- Author
- [email protected]
- Date
- 2018-07-12 20:13:19 -0700 (Thu, 12 Jul 2018)
Log Message
_javascript_ URL gives incorrect result when frame is navigated
https://bugs.webkit.org/show_bug.cgi?id=187203
<rdar://problem/41438443>
Reviewed by David Kilzer.
* loader/SubframeLoader.cpp:
(WebCore::SubframeLoader::requestFrame):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (233792 => 233793)
--- trunk/Source/WebCore/ChangeLog 2018-07-13 02:06:48 UTC (rev 233792)
+++ trunk/Source/WebCore/ChangeLog 2018-07-13 03:13:19 UTC (rev 233793)
@@ -1,3 +1,14 @@
+2018-07-12 Daniel Bates <[email protected]>
+
+ _javascript_ URL gives incorrect result when frame is navigated
+ https://bugs.webkit.org/show_bug.cgi?id=187203
+ <rdar://problem/41438443>
+
+ Reviewed by David Kilzer.
+
+ * loader/SubframeLoader.cpp:
+ (WebCore::SubframeLoader::requestFrame):
+
2018-07-12 Alex Christensen <[email protected]>
Reduce size of WebCore::URL
Modified: trunk/Source/WebCore/loader/SubframeLoader.cpp (233792 => 233793)
--- trunk/Source/WebCore/loader/SubframeLoader.cpp 2018-07-13 02:06:48 UTC (rev 233792)
+++ trunk/Source/WebCore/loader/SubframeLoader.cpp 2018-07-13 03:13:19 UTC (rev 233793)
@@ -36,6 +36,7 @@
#include "ContentSecurityPolicy.h"
#include "DiagnosticLoggingClient.h"
#include "DiagnosticLoggingKeys.h"
+#include "DocumentLoader.h"
#include "Frame.h"
#include "FrameLoader.h"
#include "FrameLoaderClient.h"
@@ -85,11 +86,16 @@
if (shouldConvertInvalidURLsToBlank() && !url.isValid())
url = ""
+ bool hasExistingFrame = ownerElement.contentFrame();
Frame* frame = loadOrRedirectSubframe(ownerElement, url, frameName, lockHistory, lockBackForwardList);
if (!frame)
return false;
- if (!scriptURL.isEmpty() && ownerElement.isURLAllowed(scriptURL))
+ // If we create a new subframe then an empty document is loaded into it synchronously and may
+ // cause script execution (say, via a DOM load event handler) that can do anything, including
+ // navigating the subframe. We only want to evaluate scriptURL if the frame has not been navigated.
+ bool canExecuteScript = hasExistingFrame || (frame->loader().documentLoader() && frame->loader().documentLoader()->originalURL() == blankURL());
+ if (!scriptURL.isEmpty() && canExecuteScript && ownerElement.isURLAllowed(scriptURL))
frame->script().executeIfJavaScriptURL(scriptURL);
return true;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
