Cancel javascript: URL navigations if the frame was navigated.

third_party/WebKit/Source/core/loader/FrameLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  * Copyright (C) 2011 Kris Jordan <krisjordan@gmail.com>
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ skipping 298 matching lines @@
 // This is only called by ScriptController::executeScriptIfJavaScriptURL
 // and always contains the result of evaluating a javascript: url.
 // This is the <iframe src="javascript:'html'"> case.
 void FrameLoader::replaceDocumentWhileExecutingJavaScriptURL(const String& source, Document* ownerDocument)
 {
     if (!m_frame->document()->loader())
         return;
 
     // DocumentLoader::replaceDocumentWhileExecutingJavaScriptURL can cause the DocumentLoader to get deref'ed and possible destroyed,
     // so protect it with a RefPtr.
     RefPtrWillBeRawPtr<DocumentLoader> documentLoader(m_frame->document()->loader());

[haraken, 2015/11/16 08:35:59]

Nit: It would be better to move this to just above
documentLoader->replaceDocumentWhileExecutingJavaScriptURL.

+    RefPtrWillBeRawPtr<Document> originalDocument(m_frame->document());
 
     UseCounter::count(*m_frame->document(), UseCounter::ReplaceDocumentViaJavaScriptURL);
 
     // Prepare a DocumentInit before clearing the frame, because it may need to
     // inherit an aliased security context.
     DocumentInit init(m_frame->document()->url(), m_frame);
     init.withNewRegistrationContext();
 
     stopAllLoaders();
     m_frame->detachChildren();
     m_frame->document()->detach();
     clear();
 
     // detachChildren() potentially detaches the frame from the document. The
     // loading cannot continue in that case.
     if (!m_frame->page())
         return;
 
+    // Detaching plugins in Document::detach() can run a nested message loop, which may have
+    // resulted in loading a new, potentially cross-origin document. Cancel the JS URL navigation.
+    if (originalDocument != m_frame->document())

[dcheng, 2015/11/16 08:24:29]

I considered two other approaches:
- Checking m_frame->document()->loader() == documentLoader: this breaks
javascript: URL navigation in the initial empty document case.
- ownerDocument != m_frame->document(): this doesn't work if another Document
other than this one initiated the JS url navigation

[Nate Chapin, 2015/11/16 19:16:34]

...can we just stop the madness and disable navigation inside detach? What does
that break?

+        return;
+
     client()->transitionToCommittedForNewPage();
     documentLoader->replaceDocumentWhileExecutingJavaScriptURL(init, source, ownerDocument);
 }
 
 void FrameLoader::receivedMainResourceRedirect(const KURL& newURL)
 {
     client()->dispatchDidReceiveServerRedirectForProvisionalLoad();
     // If a back/forward navigation redirects cross-origin, don't reuse any state from the HistoryItem.
     if (m_provisionalItem && !SecurityOrigin::create(m_provisionalItem->url())->isSameSchemeHostPort(SecurityOrigin::create(newURL).get()))
         m_provisionalItem.clear();
@@ skipping 1202 matching lines @@
     // FIXME: We need a way to propagate insecure requests policy flags to
     // out-of-process frames. For now, we'll always use default behavior.
     if (!parentFrame->isLocalFrame())
         return nullptr;
 
     ASSERT(toLocalFrame(parentFrame)->document());
     return toLocalFrame(parentFrame)->document()->insecureNavigationsToUpgrade();
 }
 
 } // namespace blink