Track whether an element was inserted via document.write

third_party/WebKit/Source/core/html/parser/HTMLConstructionSite.cpp

 /*
  * Copyright (C) 2010 Google, Inc. All Rights Reserved.
  * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 634 matching lines @@
 
 void HTMLConstructionSite::insertScriptElement(AtomicHTMLToken* token)
 {
     // http://www.whatwg.org/specs/web-apps/current-work/multipage/scripting-1.html#already-started
     // http://html5.org/specs/dom-parsing.html#dom-range-createcontextualfragment
     // For createContextualFragment, the specifications say to mark it parser-inserted and already-started and later unmark them.
     // However, we short circuit that logic to avoid the subtree traversal to find script elements since scripts can never see
     // those flags or effects thereof.
     const bool parserInserted = m_parserContentPolicy != AllowScriptingContentAndDoNotMarkAlreadyStarted;
     const bool alreadyStarted = m_isParsingFragment && parserInserted;
-    RefPtrWillBeRawPtr<HTMLScriptElement> element = HTMLScriptElement::create(ownerDocumentForCurrentNode(), parserInserted, alreadyStarted);
+    // TODO(csharrison): This logic only works if the tokenizer/parser was not
+    // blocked waiting for scripts when the element was inserted. This usually
+    // fails for instance, on second document.write if a script writes twice in
+    // a row. To fix this, the parser might have to keep track of raw string
+    // position.
+    const bool createdDuringDocumentWrite = ownerDocumentForCurrentNode().isInDocumentWrite();
+    RefPtrWillBeRawPtr<HTMLScriptElement> element = HTMLScriptElement::create(ownerDocumentForCurrentNode(), parserInserted, alreadyStarted, createdDuringDocumentWrite);

[kouhei (in TOK), 2016/03/18 02:24:26]

I think this is ok in this CL, but I'd appreciate if you would do the clean up
of {parserInserted,alreadyStarted,createdDuringDocumentWrite} flags.
I'm starting to feel guilty about passing multiple bools around in function
arguments.
I think it would make sense to have a flag enum ElementConstructionContextFlag
or something at this point.

[Charlie Harrison, 2016/03/18 14:10:47]

I'll do this refactor in this CL, but I'm hitting issues here:
https://code.google.com/p/chromium/codesearch#chromium/src/out/Debug/gen/blin...

How can we change the generated code?

[kouhei (in TOK), 2016/03/22 04:18:39]

See make_element_factory.py
https://code.google.com/p/chromium/codesearch#chromium/src/third_party/WebKit...

     setAttributes(element.get(), token, m_parserContentPolicy);
     if (scriptingContentIsAllowed(m_parserContentPolicy))
         attachLater(currentNode(), element);
     m_openElements.push(HTMLStackItem::create(element.release(), token));
 }
 
 void HTMLConstructionSite::insertForeignElement(AtomicHTMLToken* token, const AtomicString& namespaceURI)
 {
     ASSERT(token->type() == HTMLToken::StartTag);
     notImplemented(); // parseError when xmlns or xmlns:xlink are wrong.
@@ skipping 205 matching lines @@
     queueTask(task);
 }
 
 DEFINE_TRACE(HTMLConstructionSite::PendingText)
 {
     visitor->trace(parent);
     visitor->trace(nextChild);
 }
 
 } // namespace blink