Deflake http/tests/security/subresourceIntegrity/subresource-integrity-style-blocked.html

Deflake http/tests/security/subresourceIntegrity/subresource-integrity-style-blocked.html

Several things make this test flaky:
1) Console output depends on whether the parser has finished or not. To
   make the console output deterministic, wait until the document has
   loaded before triggering CSS loads with subresource integrity checks.
2) Stylesheet loads might not complete in order. Stylesheet loading is
   now serialized.
In addition, Blink now fires an 'error' event at the link element if the
load is blocked due to failing the subresource integrity check.

BUG=421298
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=187315

[dcheng, 2014-11-11 09:48:04]

dcheng@chromium.org changed reviewers:
+ jww@chromium.org, mkwst@chromium.org, morrita@chromium.org

[dcheng, 2014-11-11 09:54:10]

Please review this patch with care.

In particular:
1) I'm not actually familiar with stylesheet loading, so I might be notifying an
error in completely the wrong way. It seems like most code usually goes through
StyleSheetContents::checkLoaded() though--so maybe I should be doing
cachedStyleSheet->checkLoaded()? I have no idea what cachedStyleSheet refers to
though.
2) The SRI spec (http://www.w3.org/TR/SRI/#the-link-element-1) specifically
mentions only firing error events if the blocked resource is same-origin to the
Document. I have no idea why we have this restriction? In any case, I
implemented the event but omitted the origin check. It seems kind of pointless
to have an origin check here--if you really wanted to know if it succeeded or
not, you could probably just poll other observable properties. So we may as well
just fire an error event.

[Mike West, 2014-11-11 09:58:33]

mkwst@chromium.org changed required reviewers:
+ morrita@chromium.org

[Mike West, 2014-11-11 09:58:33]

LGTM, though I think waiting for morrita to sign off on the notification
mechanism is a good idea.

Regarding the origin restriction, that's a hold-over from an earlier version of
the draft. We now require CORS headers to open up the resource to SRI checks
(though we haven't implemented those yet), so there's no longer risk of SRI
exposing cross-origin information that that origin hasn't explicitly made
available.

jww@: Do you want to tackle the CORS check, or should I put that on my list?

[dcheng, 2014-11-11 10:43:52]

dcheng@chromium.org changed required reviewers:
- morrita@chromium.org

[dcheng, 2014-11-11 10:43:53]

It looks like we fire events already for CORS checks
(http/tests/security/link-crossorigin-stylesheet-no-cors.html). I'm not sure
where/how it's triggered though. Would it make sense to try to do the SRI checks
in a similar place?

[jww, 2014-12-03 17:30:19]

Sorry for being so late to the party here, but this LGTM. Thanks a lot, Daniel!

Mike, I'm happy to take over the CORS checks. I just filed
https://crbug.com/438663 to track it.

[Hajime Morrita, 2014-12-11 17:38:02]

On 2014/12/03 17:30:19, jww wrote:
> Sorry for being so late to the party here, but this LGTM. Thanks a lot,
Daniel!
> 
> Mike, I'm happy to take over the CORS checks. I just filed
> https://crbug.com/438663 to track it.

lgtm. I'm sorry for overlooking this :-(

[dcheng, 2014-12-11 18:25:23]

The CQ bit was checked by dcheng@chromium.org

[commit-bot: I haz the power, 2014-12-11 18:26:14]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/718633002/40001

[commit-bot: I haz the power, 2014-12-11 18:29:44]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2014-12-11 18:29:44]

Try jobs failed on following builders:
  mac_blink_compile_dbg on tryserver.blink
(http://build.chromium.org/p/tryserver.blink/builders/mac_blink_compile_dbg/bu...)
  linux_gpu on tryserver.chromium.gpu
(http://build.chromium.org/p/tryserver.chromium.gpu/builders/linux_gpu/builds/...)

[dcheng, 2014-12-11 18:32:49]

The CQ bit was checked by dcheng@chromium.org

[commit-bot: I haz the power, 2014-12-11 18:33:18]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/718633002/60001

[commit-bot: I haz the power, 2014-12-11 20:38:08]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2014-12-11 20:38:09]

Try jobs failed on following builders:
  linux_blink_rel on tryserver.blink
(http://build.chromium.org/p/tryserver.blink/builders/linux_blink_rel/builds/3...)

[dcheng, 2014-12-16 22:54:10]

The CQ bit was checked by dcheng@chromium.org

[commit-bot: I haz the power, 2014-12-16 22:55:06]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/718633002/80001

[commit-bot: I haz the power, 2014-12-17 01:19:09]

Committed patchset #5 (id:80001) as
https://src.chromium.org/viewvc/blink?view=rev&revision=187315