Custom Elements: Check Definition in createElement, Create Customized Built-in Elements Sync

third_party/WebKit/Source/core/dom/custom/CustomElement.cpp

Index: third_party/WebKit/Source/core/dom/custom/CustomElement.cpp
diff --git a/third_party/WebKit/Source/core/dom/custom/CustomElement.cpp b/third_party/WebKit/Source/core/dom/custom/CustomElement.cpp
index c86abfe261a64bc17246a54fb299ed9729dde3cd..9c1f3d9159f7e6d810c01ee75877ddab27e5190b 100644
--- a/third_party/WebKit/Source/core/dom/custom/CustomElement.cpp
+++ b/third_party/WebKit/Source/core/dom/custom/CustomElement.cpp
@@ -4,6 +4,8 @@
 
 #include "core/dom/custom/CustomElement.h"
 
+#include "core/HTMLElementFactory.h"
+#include "core/HTMLElementTypeHelpers.h"
 #include "core/dom/Document.h"
 #include "core/dom/QualifiedName.h"
 #include "core/dom/custom/CEReactionsScope.h"
@@ -79,21 +81,36 @@ static CustomElementDefinition* definitionFor(
 
 HTMLElement* CustomElement::createCustomElementSync(
     Document& document,
-    const AtomicString& localName) {
+    const AtomicString& localName,
+    const AtomicString& is) {
   return createCustomElementSync(
       document,
-      QualifiedName(nullAtom, localName, HTMLNames::xhtmlNamespaceURI));
+      QualifiedName(nullAtom, localName, HTMLNames::xhtmlNamespaceURI), is);
 }
 
+// https://dom.spec.whatwg.org/#concept-create-element
 HTMLElement* CustomElement::createCustomElementSync(
     Document& document,
-    const QualifiedName& tagName) {
-  DCHECK(shouldCreateCustomElement(tagName));
-  if (CustomElementDefinition* definition = definitionFor(
-          document,
-          CustomElementDescriptor(tagName.localName(), tagName.localName())))
-    return definition->createElementSync(document, tagName);
-  return createUndefinedElement(document, tagName);
+    const QualifiedName& tagName,
+    const AtomicString& is) {
+  const AtomicString& name = is.isNull() ? tagName.localName() : is;
+  DCHECK(shouldCreateCustomElement(name));

[dominicc (has gone to gerrit), 2016/11/08 08:36:29]

Could you do a debug build and try something like

createElement('div', {is: 'bar'})?

I think this 'bar' will fail the DCHECK but evade your other checks, since
shouldCreateBuiltin just checks for the presence of the dictionary.

createElement('div', {})

is another interesting test.

Try to think like an attacker--if you wanted to stress this code and make it
crash, how would you do it? Then write unit tests or layout tests (you can put
layout tests in LayoutTests/custom-elements as opposed to
LayoutTests/custom-elements/spec if they're exercising implementation details)
and make it crash. Then fix the crashes.

Running out of memory, it's OK to crash; in theory a page should never be able
to make us trigger a CHECK or DCHECK though. Failures should be defined in some
way. If the spec is deficient or unclear file spec bugs and put TODOs with links
to the spec bugs.

+  const CustomElementDescriptor desc(name, tagName.localName());
+  CustomElementDefinition* definition = definitionFor(document, desc);
+  HTMLElement* element;
+
+  if (definition && desc.isAutonomous()) {
+    // 6. If definition is non-null and we have an autonomous custom element
+    element = definition->createElementSync(document, tagName);
+  } else if (definition) {
+    // 5. If definition is non-null and we have a customized built-in element
+    element = createUndefinedElement(document, tagName);
+    definition->upgrade(element);
+  } else {
+    // 7. Otherwise
+    element = createUndefinedElement(document, tagName);
+  }
+  return element;
 }
 
 HTMLElement* CustomElement::createCustomElementAsync(
@@ -113,10 +130,15 @@ HTMLElement* CustomElement::createCustomElementAsync(
   return createUndefinedElement(document, tagName);
 }
 
+// Create a HTMLElement
 HTMLElement* CustomElement::createUndefinedElement(
     Document& document,
     const QualifiedName& tagName) {
-  DCHECK(shouldCreateCustomElement(tagName));
+  bool shouldCreateBuiltin =
+      htmlElementTypeForTag(tagName.localName()) !=
+          HTMLElementType::kHTMLUnknownElement &&
+      RuntimeEnabledFeatures::customElementsBuiltinEnabled();
+  DCHECK(shouldCreateCustomElement(tagName) || shouldCreateBuiltin);
 
   HTMLElement* element;
   if (V0CustomElement::isValidName(tagName.localName()) &&
@@ -125,6 +147,9 @@ HTMLElement* CustomElement::createUndefinedElement(
         document, tagName);
     SECURITY_DCHECK(v0element->isHTMLElement());
     element = toHTMLElement(v0element);
+  } else if (shouldCreateBuiltin) {
+    element = HTMLElementFactory::createHTMLElement(
+        tagName.localName(), document, nullptr, CreatedByCreateElement);
   } else {
     element = HTMLElement::create(tagName, document);
   }