1205251 - iframe changes it's location silently

Status: RESOLVED INVALID

(Core :: General, defect)

Description

[Sergey Rashitov]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.124 YaBrowser/15.7.2357.2877 Safari/537.36

Steps to reproduce:

Sometimes I see "Access denied" messages from sandboxes created for every iframe.
It happens on metro.us/* pages.

The order of action is:
1. I receive DOMContentLoaded event from document with location.href == 'about:blank'.
2. I create sandbox. It's principal is same as window's principal so principal.origin is metro.us.
3. Then after some time document changes it's location and code can't access any variable inside that sandbox because window principal was changed.

And I dont receive DOMContentLoaded after iframe changes it's location.

Here are the logs:
FOUND
	WindowId: 1
	origin: "http://www.metro.us"
	win.origin: null
	win.href: about:blank

TIMEOUT
	WindowId: 1
	origin: "http://tags.bluekai.com"
	win.origin: "http://tags.bluekai.com"
	win.href: "http://tags.bluekai.com/site/4651?ret=html&phint=vertical%3DLIFESTYLES&phint=trackingId%3D27a1f85b&phint=domain%3Dwww.metro.us&phint=visitorId%3Df547d742-3f06-40a3-a4d8-b37acef93698&phint=__bk_t%3DBoston%20%E2%80%93%20Metro&phint=__bk_k%3D&phint=__bk_l%3Dhttp%3A%2F%2Fwww.metro.us%2Fboston%2F&limit=6&r=83644161"


This is the code I use for tests:
function printInfo(msg, win)
{
	var id = _ids.has(win) && _ids.get(win) || null;
	var origin = Cu.getObjectPrincipal(win).origin;
	console.log(msg);
	console.log("\tWindowId:", id);
	console.log("\torigin:", origin);
	console.log("\twin.origin:", win.location.origin);
	console.log("\twin.href:", win.location.href);
}

function printAgainAfterTimeout(win, origin)
{
	setTimeout(function()
	{
		printInfo("TIMEOUT", win);
	}, 2000);
}

var _id = 1;

var _ids = new WeakMap();

function onContentLoad(event)
{
	var doc = event.target;
	if (doc instanceof HTMLDocument && doc.location.href == "about:blank")
	{
		var origin = Cu.getObjectPrincipal(doc).origin;
		if (doc.location.origin != origin)
		{
			var win = doc.defaultView;
			_ids.set(win, _id++);
			printInfo("FOUND", win);
			printAgainAfterTimeout(win, origin);
		}
	}
}

gBrowser.addEventListener("DOMContentLoaded", onContentLoad, true);




Actual results:

There is no event to detect location change.


Expected results:

I expect 'DOMContentLoaded' event after location change of iframe.

Comment 1

[Boris Zbarsky [:bzbarsky]]

There should be a DOMContentLoaded event here, yes.  But it won't have doc.location.href == "about:blank", of course.  So the above code won't print anything for that event.  Are you sure DOMContentLoaded is in fact not firing for the new thing?

Furthermore, it's possible to have DOMContentLoaded take longer than the 2 seconds you have for the timeout there.  The right way to detect a new global (possibly in a different origin) being created for a given window is to watch for a new-global notification, not DOMContentLoaded.

Comment 2

[Sergey Rashitov]

(In reply to Boris Zbarsky [:bz] from comment #1)
> There should be a DOMContentLoaded event here, yes.  But it won't have
> doc.location.href == "about:blank", of course.  So the above code won't
> print anything for that event.

Silly me... Code from above works fine after this fix.
So, most likely it's my poor sandbox management. I'll keep digging.

Sorry about these 'not bugs' and thanks for help!

Comment 3

[Boris Zbarsky [:bzbarsky]]

You're welcome, and good luck!