Move window.close implementation to DOMWindow

Source/web/tests/WebFrameTest.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 7301 matching lines @@
     ASSERT_TRUE(mainFrame()->isWebLocalFrame());
     ASSERT_TRUE(mainFrame()->firstChild()->isWebRemoteFrame());
     LocalDOMWindow* mainWindow = toWebLocalFrameImpl(mainFrame())->frame()->localDOMWindow();
     mainWindow->open(destination.string(), "frame1", "", mainWindow, mainWindow);
     ASSERT_FALSE(remoteClient.lastRequest().isNull());
     EXPECT_EQ(remoteClient.lastRequest().url(), WebURL(destination));
 
     reset();
 }
 
+class RemoteWindowCloseClient : public FrameTestHelpers::TestWebViewClient {
+public:
+    RemoteWindowCloseClient()
+        : m_closed(false)
+    {
+    }
+
+    void closeWidgetSoon() override
+    {
+        m_closed = true;
+    }
+
+    bool closed() const { return m_closed; }
+
+private:
+    bool m_closed;
+};
+
+TEST_F(WebFrameTest, WindowOpenRemoteClose)
+{
+    FrameTestHelpers::WebViewHelper mainWebView;
+    mainWebView.initialize(true);
+
+    // Create a remote window that will be closed later in the test.
+    RemoteWindowCloseClient viewClient;
+    FrameTestHelpers::TestWebRemoteFrameClient frameClient;
+    WebRemoteFrame* webRemoteFrame = frameClient.frame();
+
+    WebView* view = WebView::create(&viewClient);
+    view->setMainFrame(webRemoteFrame);
+    view->mainFrame()->setOpener(mainWebView.webView()->mainFrame());
+    webRemoteFrame->setReplicatedOrigin(WebSecurityOrigin::createFromString("http://127.0.0.1"));
+
+    LocalFrame* localFrame = toLocalFrame(toCoreFrame(mainWebView.webView()->mainFrame()));
+    RemoteFrame* remoteFrame = toRemoteFrame(toCoreFrame(frameClient.frame()));
+
+    // Attempt to close the window, which should fail as it isn't opened
+    // by a script.
+    remoteFrame->domWindow()->close(localFrame->document());
+    EXPECT_FALSE(viewClient.closed());
+
+    // Marking it as opened by a script should now allow it to be closed.
+    remoteFrame->page()->setOpenedByDOM();
+    remoteFrame->domWindow()->close(localFrame->document());
+    EXPECT_TRUE(viewClient.closed());
+
+    mainWebView.reset();

[dcheng, 2015/06/20 00:41:32]

Nit: probably not needed, since WebViewHelper should clean up after itself
(you're not doing anything particularly weird that would require this)

[nasko, 2015/06/22 12:47:44]

There is indeed a use-after-free happening in OpenedFrameTracker destructor if I
omit this. The issue is that once view->close() is called, the opened WebView is
no longer valid, yet the mainWebView has it in its list of opened windows.

I'm guessing that in regular chrome the DOMWindow::close and WebView::close
happen differently, as I wasn't able to reproduce that in the browser. Based on
reading of the code, I don't see what is different and how this works, so I'm
sure I'm missing something. Any ideas?

[dcheng, 2015/06/23 21:40:55]

That's unexpected. Can you see if setOpener() is getting called when you call
view->close() below?

+    view->close();
+}
+
 class CommitTypeWebFrameClient : public FrameTestHelpers::TestWebFrameClient {
 public:
     explicit CommitTypeWebFrameClient()
         : m_historyCommitType(WebHistoryInertCommit)
     {
     }
 
     void didCommitProvisionalLoad(WebLocalFrame*, const WebHistoryItem&, WebHistoryCommitType historyCommitType) override
     {
         m_historyCommitType = historyCommitType;
@@ skipping 403 matching lines @@
 
 TEST_F(WebFrameTest, MaxFramesDetach)
 {
     registerMockedHttpURLLoad("max-frames-detach.html");
     FrameTestHelpers::WebViewHelper webViewHelper;
     WebViewImpl* webViewImpl = webViewHelper.initializeAndLoad(m_baseURL + "max-frames-detach.html", true);
     webViewImpl->mainFrameImpl()->collectGarbage();
 }
 
 } // namespace blink