Move window.close implementation to DOMWindow

Source/web/tests/WebFrameTest.cpp

Index: Source/web/tests/WebFrameTest.cpp
diff --git a/Source/web/tests/WebFrameTest.cpp b/Source/web/tests/WebFrameTest.cpp
index 1208021f7abebdf6548dd1789490172c44c63c5e..5f48883a2975452588bf92559d98d963d4b9b995 100644
--- a/Source/web/tests/WebFrameTest.cpp
+++ b/Source/web/tests/WebFrameTest.cpp
@@ -7319,6 +7319,56 @@ TEST_F(WebFrameSwapTest, WindowOpenOnRemoteFrame)
     reset();
 }
 
+class RemoteWindowCloseClient : public FrameTestHelpers::TestWebViewClient {
+public:
+    RemoteWindowCloseClient()
+        : m_closed(false)
+    {
+    }
+
+    void closeWidgetSoon() override
+    {
+        m_closed = true;
+    }
+
+    bool closed() const { return m_closed; }
+
+private:
+    bool m_closed;
+};
+
+TEST_F(WebFrameTest, WindowOpenRemoteClose)
+{
+    FrameTestHelpers::WebViewHelper mainWebView;
+    mainWebView.initialize(true);
+
+    // Create a remote window that will be closed later in the test.
+    RemoteWindowCloseClient viewClient;
+    FrameTestHelpers::TestWebRemoteFrameClient frameClient;
+    WebRemoteFrame* webRemoteFrame = frameClient.frame();
+
+    WebView* view = WebView::create(&viewClient);
+    view->setMainFrame(webRemoteFrame);
+    view->mainFrame()->setOpener(mainWebView.webView()->mainFrame());
+    webRemoteFrame->setReplicatedOrigin(WebSecurityOrigin::createFromString("http://127.0.0.1"));
+
+    LocalFrame* localFrame = toLocalFrame(toCoreFrame(mainWebView.webView()->mainFrame()));
+    RemoteFrame* remoteFrame = toRemoteFrame(toCoreFrame(frameClient.frame()));
+
+    // Attempt to close the window, which should fail as it isn't opened
+    // by a script.
+    remoteFrame->domWindow()->close(localFrame->document());
+    EXPECT_FALSE(viewClient.closed());
+
+    // Marking it as opened by a script should now allow it to be closed.
+    remoteFrame->page()->setOpenedByDOM();
+    remoteFrame->domWindow()->close(localFrame->document());
+    EXPECT_TRUE(viewClient.closed());
+
+    mainWebView.reset();

[dcheng, 2015/06/20 00:41:32]

Nit: probably not needed, since WebViewHelper should clean up after itself
(you're not doing anything particularly weird that would require this)

[nasko, 2015/06/22 12:47:44]

There is indeed a use-after-free happening in OpenedFrameTracker destructor if I
omit this. The issue is that once view->close() is called, the opened WebView is
no longer valid, yet the mainWebView has it in its list of opened windows.

I'm guessing that in regular chrome the DOMWindow::close and WebView::close
happen differently, as I wasn't able to reproduce that in the browser. Based on
reading of the code, I don't see what is different and how this works, so I'm
sure I'm missing something. Any ideas?

[dcheng, 2015/06/23 21:40:55]

That's unexpected. Can you see if setOpener() is getting called when you call
view->close() below?

+    view->close();
+}
+
 class CommitTypeWebFrameClient : public FrameTestHelpers::TestWebFrameClient {
 public:
     explicit CommitTypeWebFrameClient()