514182 - web workers don’t fail gracefully when faced with WebKit bug

Status: RESOLVED FIXED

(Skywriter Graveyard :: Editor, defect)

Description

[Alex Iskander]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6; en-us) AppleWebKit/531.9 (KHTML, like Gecko) Version/4.0.3 Safari/531.9
Build Identifier: 

There is a situation in which “Worker” may be defined, but security issues may not allow it to function properly. In this case, worker.js doesn’t realize that Web Workers are unusable, and tries to use them anyway, causing the web app to crash.

This case should never happen, but can due to a bug in WebKit that causes the browser to get confused and think the worker request is not secure. Test using Safari 4.

Reproducible: Always

Steps to Reproduce:
1. Set up a Bespin editor (embedded or otherwise) in a server environment. If you wish, simply use /tests/manual/editor/singleeditor.html

2. Add the following at the top of the head file: <script>document.domain = document.domain;</script>

3. Open page in Safari 4. For instance: http://localhost/tests/manual/editor/singleeditor.html
Actual Results:  
The page will not load properly. If you look at the Web Inspector console, it will probably show something about a security error.

Expected Results:  
The page loads properly. Workers are disabled automatically because of the apparent WebKit bug.

I BELIEVE that this is a bug in WebKit, but I am not certain. Firefox does not exhibit the same behavior.

The document.domain=document.domain line strips the port number. Before, although document.domain may have evaluated to the string “localhost”, it really was “localhost:80”. Setting it to itself changes it to “localhost”, allowing ANY port on localhost to be accessed by JavaScript, instead of just port 80. This is very important if you are using a separate comet server, such as Orbited, and cannot proxy properly in the debug environment.

I have a patch that checks more thoroughly that workers do, indeed, work, and makes sure NOT to create a worker if they don’t. I will attach the patch in a moment.

Comment 1

[Alex Iskander]

Attachment: Patch

Contains patches for other bugs, as well, which I am submitting.

Comment 2

[Alex Iskander]

Fixed in http://hg.mozilla.org/labs/bespin/rev/272aa02709a1