Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(1011)

Issue 2764883003: Make context initialization order deterministic in WebFrame::swap(). (Closed)

Created:
3 years, 9 months ago by dcheng
Modified:
3 years, 9 months ago
Reviewers:
CC:
chromium-reviews
Target Ref:
refs/branch-heads/3029
Project:
chromium
Visibility:
Public.

Description

Make context initialization order deterministic in WebFrame::swap(). DCHECK(m_globalProxy != context()->Global()) sometimes fail. In builds with DCHECKs turned off this issue manifests with "Type Error: no access" errors in console and scripts not working. Started happening approx. in M56. Repro steps: 1. Install several extensions; 2. Visit a number of pages in a tab; 3. Do a lot of back and forward navigations quickly (not waiting till pages load). This is caused by setting the global object in WindowProxy after it was initialized. This happens when WindowProxyManagerBase::setGlobals processes a non-main world first. It sends out a didCreateScriptContext call. ExtensionFrameHelper::DidCreateScriptContext wants to know whether it is the main world script context, and compares with WebLocalFrameImpl::mainWorldScriptContext(). As a result, main world script context is initialized. At this point the call stack is like this: 1 blink::LocalWindowProxy::initialize 2 blink::ScriptController::windowProxy 3 blink::toV8Context 4 blink::ScriptState::forMainWorld 5 blink::WebLocalFrameImpl::mainWorldScriptContext 6 extensions::ExtensionFrameHelper::DidCreateScriptContext 7 content::RenderFrameImpl::didCreateScriptContext 8 blink::LocalWindowProxy::initialize 9 blink::WindowProxy::setGlobal 10 blink::WindowProxyManagerBase::setGlobals 11 blink::WebFrame::swap 12 content::RenderFrameImpl::SwapIn 13 content::RenderFrameImpl::didCommitProvisionalLoad 14 blink::FrameLoaderClientImpl::dispatchDidCommitLoad 15 blink::FrameLoader::receivedFirstData 16 blink::DocumentLoader::createWriterFor 17 blink::DocumentLoader::ensureWriter 18 blink::DocumentLoader::commitData After that WindowProxyManagerBase::setGlobals continues its work and sets the global object for the main world WindowProxy, and it becomes broken. BUG=700077 Review-Url: https://codereview.chromium.org/2743653002 Cr-Commit-Position: refs/heads/master@{#455951} (cherry picked from commit 1993f6e8c0fe533f411ae5764231072e212221ad) Review-Url: https://codereview.chromium.org/2764883003 . Cr-Commit-Position: refs/branch-heads/3029@{#337} Cr-Branched-From: 939b32ee5ba05c396eef3fd992822fcca9a2e262-refs/heads/master@{#454471} Committed: https://chromium.googlesource.com/chromium/src/+/679313e28ae3a1dfab27fa6c0920fad29d1163b5

Patch Set 1 #

Unified diffs Side-by-side diffs Delta from patch set Stats (+18 lines, -15 lines) Patch
M third_party/WebKit/Source/bindings/core/v8/WindowProxyManager.h View 1 chunk +7 lines, -4 lines 0 comments Download
M third_party/WebKit/Source/bindings/core/v8/WindowProxyManager.cpp View 1 chunk +10 lines, -10 lines 0 comments Download
M third_party/WebKit/Source/web/WebFrame.cpp View 1 chunk +1 line, -1 line 0 comments Download

Messages

Total messages: 2 (1 generated)
dcheng
3 years, 9 months ago (2017-03-21 18:50:27 UTC) #2
Message was sent while issue was closed.
Committed patchset #1 (id:1) manually as
679313e28ae3a1dfab27fa6c0920fad29d1163b5.

Powered by Google App Engine
This is Rietveld 408576698