Custom Elements: Check Definition in createElement, Create Customized Built-in Elements Sync

third_party/WebKit/Source/core/dom/custom/CustomElement.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/dom/custom/CustomElement.h"
 
+#include "core/HTMLElementFactory.h"
+#include "core/HTMLElementTypeHelpers.h"
 #include "core/dom/Document.h"
 #include "core/dom/QualifiedName.h"
 #include "core/dom/custom/CEReactionsScope.h"
 #include "core/dom/custom/CustomElementDefinition.h"
 #include "core/dom/custom/CustomElementReactionStack.h"
 #include "core/dom/custom/CustomElementRegistry.h"
 #include "core/dom/custom/V0CustomElement.h"
 #include "core/dom/custom/V0CustomElementRegistrationContext.h"
 #include "core/frame/LocalDOMWindow.h"
 #include "core/html/HTMLElement.h"
@@ skipping 55 matching lines @@
 static CustomElementDefinition* definitionFor(
     const Document& document,
     const CustomElementDescriptor desc) {
   if (CustomElementRegistry* registry = CustomElement::registry(document))
     return registry->definitionFor(desc);
   return nullptr;
 }
 
 HTMLElement* CustomElement::createCustomElementSync(
     Document& document,
-    const AtomicString& localName) {
+    const AtomicString& localName,
+    const AtomicString& is) {
   return createCustomElementSync(
       document,
-      QualifiedName(nullAtom, localName, HTMLNames::xhtmlNamespaceURI));
+      QualifiedName(nullAtom, localName, HTMLNames::xhtmlNamespaceURI), is);
 }
 
+// https://dom.spec.whatwg.org/#concept-create-element
 HTMLElement* CustomElement::createCustomElementSync(
     Document& document,
-    const QualifiedName& tagName) {
-  DCHECK(shouldCreateCustomElement(tagName));
-  if (CustomElementDefinition* definition = definitionFor(
-          document,
-          CustomElementDescriptor(tagName.localName(), tagName.localName())))
-    return definition->createElementSync(document, tagName);
-  return createUndefinedElement(document, tagName);
+    const QualifiedName& tagName,
+    const AtomicString& is) {
+  const AtomicString& name = is.isNull() ? tagName.localName() : is;
+  DCHECK(shouldCreateCustomElement(name));

[dominicc (has gone to gerrit), 2016/11/08 08:36:29]

Could you do a debug build and try something like

createElement('div', {is: 'bar'})?

I think this 'bar' will fail the DCHECK but evade your other checks, since
shouldCreateBuiltin just checks for the presence of the dictionary.

createElement('div', {})

is another interesting test.

Try to think like an attacker--if you wanted to stress this code and make it
crash, how would you do it? Then write unit tests or layout tests (you can put
layout tests in LayoutTests/custom-elements as opposed to
LayoutTests/custom-elements/spec if they're exercising implementation details)
and make it crash. Then fix the crashes.

Running out of memory, it's OK to crash; in theory a page should never be able
to make us trigger a CHECK or DCHECK though. Failures should be defined in some
way. If the spec is deficient or unclear file spec bugs and put TODOs with links
to the spec bugs.

+  const CustomElementDescriptor desc(name, tagName.localName());
+  CustomElementDefinition* definition = definitionFor(document, desc);
+  HTMLElement* element;
+
+  if (definition && desc.isAutonomous()) {
+    // 6. If definition is non-null and we have an autonomous custom element
+    element = definition->createElementSync(document, tagName);
+  } else if (definition) {
+    // 5. If definition is non-null and we have a customized built-in element
+    element = createUndefinedElement(document, tagName);
+    definition->upgrade(element);
+  } else {
+    // 7. Otherwise
+    element = createUndefinedElement(document, tagName);
+  }
+  return element;
 }
 
 HTMLElement* CustomElement::createCustomElementAsync(
     Document& document,
     const QualifiedName& tagName) {
   DCHECK(shouldCreateCustomElement(tagName));
 
   // To create an element:
   // https://dom.spec.whatwg.org/#concept-create-element
   // 6. If definition is non-null, then:
   // 6.2. If the synchronous custom elements flag is not set:
   if (CustomElementDefinition* definition = definitionFor(
           document,
           CustomElementDescriptor(tagName.localName(), tagName.localName())))
     return definition->createElementAsync(document, tagName);
 
   return createUndefinedElement(document, tagName);
 }
 
+// Create a HTMLElement
 HTMLElement* CustomElement::createUndefinedElement(
     Document& document,
     const QualifiedName& tagName) {
-  DCHECK(shouldCreateCustomElement(tagName));
+  bool shouldCreateBuiltin =
+      htmlElementTypeForTag(tagName.localName()) !=
+          HTMLElementType::kHTMLUnknownElement &&
+      RuntimeEnabledFeatures::customElementsBuiltinEnabled();
+  DCHECK(shouldCreateCustomElement(tagName) || shouldCreateBuiltin);
 
   HTMLElement* element;
   if (V0CustomElement::isValidName(tagName.localName()) &&
       document.registrationContext()) {
     Element* v0element = document.registrationContext()->createCustomTagElement(
         document, tagName);
     SECURITY_DCHECK(v0element->isHTMLElement());
     element = toHTMLElement(v0element);
+  } else if (shouldCreateBuiltin) {
+    element = HTMLElementFactory::createHTMLElement(
+        tagName.localName(), document, nullptr, CreatedByCreateElement);
   } else {
     element = HTMLElement::create(tagName, document);
   }
 
   element->setCustomElementState(CustomElementState::Undefined);
 
   return element;
 }
 
 HTMLElement* CustomElement::createFailedElement(Document& document,
@@ skipping 75 matching lines @@
   if (!registry)
     return;
   if (CustomElementDefinition* definition = registry->definitionFor(
           CustomElementDescriptor(element->localName(), element->localName())))
     definition->enqueueUpgradeReaction(element);
   else
     registry->addCandidate(element);
 }
 
 }  // namespace blink