2010-08-13 Mihai Parparita <mihaip@chromium.org>

Reviewed by Dimitri Glazkov. Session history should skip over JS redirects https://bugs.webkit.org/show_bug.cgi?id=42861 Lock the back/forward list for location changes and form submits that happen before the onload event fires that are not the result of user gestures. http/tests/history tests now pass, their expectations were updated accordingly. Other tests needed a setTimeout wrapper around location changes and form submits during onload, otherwise they would not generate history entries as expected anymore. * fast/css/target-fragment-match.html: * fast/dom/location-hash.html: * fast/dom/Geolocation/resources/cached-page-1.html: * fast/dom/Window/timer-resume-on-navigation-back.html: * fast/events/pageshow-pagehide-on-back-cached-with-frames-expected.txt: * fast/events/pageshow-pagehide-on-back-cached-with-frames.html: * fast/forms/button-state-restore.html: * fast/forms/state-restore-to-non-autocomplete-form.html: * fast/forms/state-restore-to-non-edited-controls.html: * fast/frames/resources/cached-page-1.html: * fast/frames/resources/cached-page-2.html: * fast/harness/resources/cached-page-1.html: * fast/harness/resources/cached-page-with-data-urls.html: * fast/history/gesture-before-onload-expected.txt: Added. * fast/history/gesture-before-onload.html: Added. * fast/history/history-length.html: * fast/history/resources/gesture-before-onload-target.html: Added. * fast/history/saves-state-after-fragment-nav.html: * fast/loader/input-element-page-cache-crash.html: * fast/loader/stateobjects/document-destroyed-navigate-back.html: * fast/loader/stateobjects/pushstate-clears-forward-history.html: * fast/loader/subframe-navigate-during-main-frame-load.html: * http/tests/history/back-to-post.php: * http/tests/history/redirect-js-document-location-before-load-expected.txt: * http/tests/history/redirect-js-form-submit-before-load-expected.txt: * http/tests/history/redirect-js-location-assign-before-load-expected.txt: * http/tests/history/redirect-js-location-before-load-expected.txt: * http/tests/history/redirect-js-location-href-before-load-expected.txt: * http/tests/loading/307-after-303-after-post-expected.txt: * http/tests/loading/redirect-methods-expected.txt: * http/tests/navigation/resources/back-send-referrer-helper.php: * http/tests/navigation/resources/document-location.js: (start): * http/tests/navigation/resources/submit-to-fragment.pl: * security/autocomplete-cleared-on-back.html: * storage/hash-change-with-xhr.js: (updateDatabase): (invokeBack): (runTest): (runTestsInner): 2010-08-13 Mihai Parparita <mihaip@chromium.org> Reviewed by Dimitri Glazkov. Session history should skip over JS redirects https://bugs.webkit.org/show_bug.cgi?id=42861 Lock the back/forward list for location changes and form submits that happen before the onload event fires that are not the result of user gestures. Made form submission (at the ScheduledFormSubmission level) more similar to ScheduledURLNavigation by having it call clientRedirected too, fixing a long-standing FIXME. Test: fast/history/gesture-before-onload-location-href.html, fast/history/gesture-before-onload-form-submit.html and updated expectations for http/tests/history tests that used to fail. * loader/FormSubmission.cpp: (WebCore::FormSubmission::requestURL): (WebCore::FormSubmission::populateFrameLoadRequest): * loader/FormSubmission.h: * loader/RedirectScheduler.cpp: (WebCore::ScheduledFormSubmission::ScheduledFormSubmission): (WebCore::ScheduledFormSubmission::fire): (WebCore::ScheduledFormSubmission::didStartTimer): (WebCore::ScheduledFormSubmission::didStopTimer): (WebCore::RedirectScheduler::scheduleRedirect): (WebCore::RedirectScheduler::mustLockBackForwardList): (WebCore::RedirectScheduler::scheduleLocationChange): (WebCore::RedirectScheduler::scheduleFormSubmission): * loader/RedirectScheduler.h: Canonical link: https://commits.webkit.org/56140@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@65340 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebKit · Aug 13, 2010 · 3049597eb429afa7e6371e3585df9db7b78ed604 · 3049597
1 parent 9f47900
commit 3049597eb429afa7e6371e3585df9db7b78ed604
Showing 79 changed files with 527 additions and 235 deletions.
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
@@ -1,3 +1,61 @@
+2010-08-13  Mihai Parparita  <mihaip@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Session history should skip over JS redirects
+        https://bugs.webkit.org/show_bug.cgi?id=42861
+
+        Lock the back/forward list for location changes and form submits that
+        happen before the onload event fires that are not the result of user
+        gestures.
+
+        http/tests/history tests now pass, their expectations were updated 
+        accordingly. Other tests needed a setTimeout wrapper around location
+        changes and form submits during onload, otherwise they would not
+        generate history entries as expected anymore.
+
+        * fast/css/target-fragment-match.html:
+        * fast/dom/location-hash.html:
+        * fast/dom/Geolocation/resources/cached-page-1.html:
+        * fast/dom/Window/timer-resume-on-navigation-back.html:
+        * fast/events/pageshow-pagehide-on-back-cached-with-frames-expected.txt:
+        * fast/events/pageshow-pagehide-on-back-cached-with-frames.html:
+        * fast/forms/button-state-restore.html:
+        * fast/forms/state-restore-to-non-autocomplete-form.html:
+        * fast/forms/state-restore-to-non-edited-controls.html:
+        * fast/frames/resources/cached-page-1.html:
+        * fast/frames/resources/cached-page-2.html:
+        * fast/harness/resources/cached-page-1.html:
+        * fast/harness/resources/cached-page-with-data-urls.html:
+        * fast/history/gesture-before-onload-expected.txt: Added.
+        * fast/history/gesture-before-onload.html: Added.
+        * fast/history/history-length.html:
+        * fast/history/resources/gesture-before-onload-target.html: Added.
+        * fast/history/saves-state-after-fragment-nav.html:
+        * fast/loader/input-element-page-cache-crash.html:
+        * fast/loader/stateobjects/document-destroyed-navigate-back.html:
+        * fast/loader/stateobjects/pushstate-clears-forward-history.html:
+        * fast/loader/subframe-navigate-during-main-frame-load.html:
+        * http/tests/history/back-to-post.php:
+        * http/tests/history/redirect-js-document-location-before-load-expected.txt:
+        * http/tests/history/redirect-js-form-submit-before-load-expected.txt:
+        * http/tests/history/redirect-js-location-assign-before-load-expected.txt:
+        * http/tests/history/redirect-js-location-before-load-expected.txt:
+        * http/tests/history/redirect-js-location-href-before-load-expected.txt:
+        * http/tests/loading/307-after-303-after-post-expected.txt:
+        * http/tests/loading/redirect-methods-expected.txt:
+        * http/tests/navigation/resources/back-send-referrer-helper.php:
+        * http/tests/navigation/resources/document-location.js:
+        (start):
+        * http/tests/navigation/resources/submit-to-fragment.pl:
+        * security/autocomplete-cleared-on-back.html:
+        * storage/hash-change-with-xhr.js:
+        (updateDatabase):
+        (invokeBack):
+        (runTest):
+        (runTestsInner):
+
+
 2010-08-13  Sam Weinig  <sam@webkit.org>
 
         Rubber-stamped by Beth Dakin and Ban Bernstein.

diff --git a/LayoutTests/fast/css/target-fragment-match.html b/LayoutTests/fast/css/target-fragment-match.html
@@ -11,6 +11,12 @@
 {
     if (window.layoutTestController)
         layoutTestController.waitUntilDone();
+
+    // Location changes need to happen outside the onload handler to generate history entries.
+    setTimeout(runTest, 0);
+}
+
+function runTest() {
     window.location.hash ='#target-01';
     document.body.offsetTop;
     window.history.back(); // This queues up a navigation, so we need to delay the call to notifyDone.

diff --git a/LayoutTests/fast/dom/Geolocation/resources/cached-page-1.html b/LayoutTests/fast/dom/Geolocation/resources/cached-page-1.html
@@ -3,7 +3,8 @@
     var geolocation = navigator.geolocation;
     if (window.opener.reportPageOneOnload() == 1) {
         window.opener.debug('resources/cached-page-1.html about to navigate to resources/cached-page-2.html')
-        location.href = 'cached-page-2.html';
+        // Location changes need to happen outside the onload handler to generate history entries.
+        setTimeout(function() {location.href = 'cached-page-2.html';}, 0);
     }
 }
 </script>

diff --git a/LayoutTests/fast/dom/Window/timer-resume-on-navigation-back.html b/LayoutTests/fast/dom/Window/timer-resume-on-navigation-back.html
@@ -18,9 +18,12 @@
       layoutTestController.waitUntilDone();
       layoutTestController.overridePreference("WebKitUsesPageCachePreferenceKey", 1);
     }
-    window.setTimeout("verify()", timeoutValue);
-    timestamp = new Date().getTime();
-    window.location.href = "data:text/html,<body onload='history.back()'></body>";
+    // Location changes need to happen outside the onload handler to generate history entries.
+    setTimeout(function() {
+      window.setTimeout(verify, timeoutValue);
+      timestamp = new Date().getTime();
+      window.location.href = "data:text/html,<body onload='history.back()'></body>";
+    }, 0);
 }
 
 </script>

diff --git a/LayoutTests/fast/dom/location-hash.html b/LayoutTests/fast/dom/location-hash.html
@@ -87,8 +87,9 @@
         numErrors = 0;
         originalLocation = window.location.href;
         originalHistoryLength = window.history.length;
-
-        step();
+
+        // Location changes need to happen outside the onload handler to generate history entries.
+        setTimeout(step, 0);
     }
     </script>
 </head>

diff --git a/LayoutTests/fast/events/pageshow-pagehide-on-back-cached-with-frames-expected.txt b/LayoutTests/fast/events/pageshow-pagehide-on-back-cached-with-frames-expected.txt
@@ -1,16 +1,16 @@
+CONSOLE MESSAGE: line 20: ***Top level frame being parsed for the initial page load***
+CONSOLE MESSAGE: line 20: Subsubframe window.onload
+CONSOLE MESSAGE: line 20: Subsubframe window.onpageshow, target = [object HTMLDocument], persisted = false
+CONSOLE MESSAGE: line 20: Subframe window.onload
+CONSOLE MESSAGE: line 20: Subframe window.onpageshow, target = [object HTMLDocument], persisted = false
+CONSOLE MESSAGE: line 20: Main frame window.onload
+CONSOLE MESSAGE: line 20: Main frame window.onpageshow, target = [object HTMLDocument], persisted = false
+CONSOLE MESSAGE: line 20: ***Navigating top-level frame to a page that will immediately navigate back to this one***
+CONSOLE MESSAGE: line 20: Main frame window.onpagehide, target = [object HTMLDocument], persisted = true
+CONSOLE MESSAGE: line 20: Subframe window.onpagehide, target = [object HTMLDocument], persisted = true
+CONSOLE MESSAGE: line 20: Subsubframe window.onpagehide, target = [object HTMLDocument], persisted = true
+CONSOLE MESSAGE: line 20: Subsubframe window.onpageshow, target = [object HTMLDocument], persisted = true
+CONSOLE MESSAGE: line 20: Subframe window.onpageshow, target = [object HTMLDocument], persisted = true
+CONSOLE MESSAGE: line 20: Main frame window.onpageshow, target = [object HTMLDocument], persisted = true
 Test pageshow/pagehide event behavior when navigating away from a page with frames, putting the page in the page cache, then back to it.
-***Top level frame being parsed for the initial page load***
-Subsubframe window.onload
-Subsubframe window.onpageshow, target = [object HTMLDocument], persisted = false
-Subframe window.onload
-Subframe window.onpageshow, target = [object HTMLDocument], persisted = false
-Main frame window.onload
-Main frame window.onpageshow, target = [object HTMLDocument], persisted = false
-***Navigating top-level frame to a page that will immediately navigate back to this one***
-Main frame window.onpagehide, target = [object HTMLDocument], persisted = true
-Subframe window.onpagehide, target = [object HTMLDocument], persisted = true
-Subsubframe window.onpagehide, target = [object HTMLDocument], persisted = true
-Subsubframe window.onpageshow, target = [object HTMLDocument], persisted = true
-Subframe window.onpageshow, target = [object HTMLDocument], persisted = true
-Main frame window.onpageshow, target = [object HTMLDocument], persisted = true
 
diff --git a/LayoutTests/fast/events/pageshow-pagehide-on-back-cached-with-frames.html b/LayoutTests/fast/events/pageshow-pagehide-on-back-cached-with-frames.html
@@ -14,8 +14,10 @@
 
 function log(message)
 {
-    var log = document.getElementById("log");
-    log.innerHTML += message + "\n";
+    // Logging to the console instead of the "log" DIV in the DOM because
+    // otherwise we trigger the assert mentioned at http://webkit.org/b/43152
+    // (since we log during pagehide)
+    console.log(message);
 }
 
 log("***Top level frame being parsed for the initial page load***");
@@ -31,7 +33,8 @@
             layoutTestController.notifyDone();
     } else {
         log("***Navigating top-level frame to a page that will immediately navigate back to this one***");
-        window.location.href = "data:text/html,<script>history.back();</scr" + "ipt>";
+        // Location changes need to happen outside the onload handler to generate history entries.
+        setTimeout(function() {window.location.href = "data:text/html,<script>history.back();</scr" + "ipt>";}, 0);
     }
 }
 

diff --git a/LayoutTests/fast/forms/button-state-restore.html b/LayoutTests/fast/forms/button-state-restore.html
@@ -31,7 +31,9 @@
             input.value = "FAIL";
 
             var form = document.getElementById("form");
-            form.submit();
+
+            // Submit form in a timeout to make sure that we create a new back/forward list item.            
+            setTimeout(function() {form.submit();}, 0);
         }
     </script>
 </head>

diff --git a/LayoutTests/fast/forms/state-restore-to-non-autocomplete-form.html b/LayoutTests/fast/forms/state-restore-to-non-autocomplete-form.html
@@ -38,7 +38,8 @@
     document.getElementById('input2').value = 'value2';
     document.getElementById('textarea2').value = 'good';
     document.getElementById('select2').value = 'BSD';
-    document.getElementById('form2').submit();
+    // Submit form in a timeout to make sure that we create a new back/forward list item.            
+    setTimeout(function() {document.getElementById('form2').submit();}, 0);
 } else {
     // Second visit.
     debug('Controls in the first form should have their default values:');

diff --git a/LayoutTests/fast/forms/state-restore-to-non-edited-controls.html b/LayoutTests/fast/forms/state-restore-to-non-edited-controls.html
@@ -37,7 +37,8 @@
     makeForm(parent, '1', '1', '1', '1', '1', '1', '1', '1');
 
     document.getElementById('text1').value = 'edit';
-    document.getElementById('form1').submit();
+    // Submit form in a timeout to make sure that we create a new back/forward list item.            
+    setTimeout(function() {document.getElementById('form1').submit();}, 0);
 } else {
     // Second visit.
     makeForm(parent, '2', '2', '2', '2', '2', '2', '2', '2');

diff --git a/LayoutTests/fast/frames/resources/cached-page-1.html b/LayoutTests/fast/frames/resources/cached-page-1.html
@@ -17,7 +17,8 @@
     intervalId = setInterval(endTest, 100);
 
     window.opener.log("page-1, about to navigate to page-2.")
-    location.href = "cached-page-2.html";
+    // Location changes need to happen outside the onload handler to generate history entries.
+    setTimeout(function() {location.href = "cached-page-2.html";}, 0);
 }
 
 // This unload handler exists just to make sure this page is not added

diff --git a/LayoutTests/fast/frames/resources/cached-page-2.html b/LayoutTests/fast/frames/resources/cached-page-2.html
@@ -19,7 +19,8 @@
     intervalId = setInterval(goBack, 20);
 
     window.opener.log("page-2, about to navigate to page-3.")
-    location.href = "cached-page-3.html";
+    // Location changes need to happen outside the onload handler to generate history entries.
+    setTimeout(function() {location.href = "cached-page-3.html";}, 0);
 }
 </script>
 <body onload="loadNext()">

diff --git a/LayoutTests/fast/harness/resources/cached-page-1.html b/LayoutTests/fast/harness/resources/cached-page-1.html
@@ -22,7 +22,8 @@
     intervalId = setInterval(check, 10);
 
     window.opener.log("page-1, about to navigate to page-2.")
-    location.href = "cached-page-2.html";
+    // Location changes need to happen outside the onload handler to generate history entries.
+    setTimeout(function() {location.href = "cached-page-2.html";}, 0);
 }
 </script>
 <body onload="loadNext()"></body>
diff --git a/LayoutTests/fast/harness/resources/cached-page-with-data-urls.html b/LayoutTests/fast/harness/resources/cached-page-with-data-urls.html
@@ -18,7 +18,8 @@
     intervalId = setInterval(check, 10);
 
     window.opener.log("page with data urls, about to navigate to page-2.")
-    location.href = "cached-page-2.html";
+    // Location changes need to happen outside the onload handler to generate history entries.
+    setTimeout(function() {location.href = "cached-page-2.html";}, 0);
 }
 </script>
 <body onload="loadNext()">

diff --git a/LayoutTests/fast/history/gesture-before-onload-form-submit-expected.txt b/LayoutTests/fast/history/gesture-before-onload-form-submit-expected.txt
@@ -0,0 +1,9 @@
+This page is the target of a redirect.
+
+PASS: History item count should be 2 and is.
+
+
+============== Back Forward List ==============
+        (file test):fast/history/gesture-before-onload-form-submit.html  **nav target**
+curr->  (file test):fast/history/resources/gesture-before-onload-target.html?#2  **nav target**
+===============================================
diff --git a/LayoutTests/fast/history/gesture-before-onload-form-submit.html b/LayoutTests/fast/history/gesture-before-onload-form-submit.html
@@ -0,0 +1,30 @@
+<head>
+</head>
+<body onload="onload()">
+  <form action="resources/gesture-before-onload-target.html#2">
+    <input type="submit" id="nav-button" value="Navigate">
+  </form>
+  <div id="manual-explanation" style="display: none; color: blue">When running this test outside of DRT, please click on the "Navigate" button.</div>
+</body>
+<script>
+  if (window.layoutTestController) {
+      layoutTestController.clearBackForwardList();
+      layoutTestController.waitUntilDone();
+  }
+
+  if (window.eventSender) {
+      var navButtonNode = document.getElementById('nav-button');
+      eventSender.mouseMoveTo(
+          navButtonNode.offsetLeft + navButtonNode.offsetWidth / 2,
+          navButtonNode.offsetTop + navButtonNode.offsetHeight / 2);
+      eventSender.mouseDown();
+      eventSender.mouseUp();
+  } else {
+      document.getElementById('manual-explanation').style.display = '';
+  }
+
+  function onload() {
+      window.console.log('FAIL: Should not have reached onload before navigating away');
+  }
+</script>
+
diff --git a/LayoutTests/fast/history/gesture-before-onload-location-href-expected.txt b/LayoutTests/fast/history/gesture-before-onload-location-href-expected.txt
@@ -0,0 +1,9 @@
+This page is the target of a redirect.
+
+PASS: History item count should be 2 and is.
+
+
+============== Back Forward List ==============
+        (file test):fast/history/gesture-before-onload-location-href.html  **nav target**
+curr->  (file test):fast/history/resources/gesture-before-onload-target.html#2  **nav target**
+===============================================
diff --git a/LayoutTests/fast/history/gesture-before-onload-location-href.html b/LayoutTests/fast/history/gesture-before-onload-location-href.html
@@ -0,0 +1,32 @@
+<head>
+</head>
+<body onload="onload()">
+  <button id="nav-button" onclick="nav();">Navigate</button>
+  <div id="manual-explanation" style="display: none; color: blue">When running this test outside of DRT, please click on the "Navigate" button.</div>
+</body>
+<script>
+  if (window.layoutTestController) {
+      layoutTestController.clearBackForwardList();
+      layoutTestController.waitUntilDone();
+  }
+
+  if (window.eventSender) {
+      var navButtonNode = document.getElementById('nav-button');
+      eventSender.mouseMoveTo(
+          navButtonNode.offsetLeft + navButtonNode.offsetWidth / 2,
+          navButtonNode.offsetTop + navButtonNode.offsetHeight / 2);
+      eventSender.mouseDown();
+      eventSender.mouseUp();
+  } else {
+      document.getElementById('manual-explanation').style.display = '';
+  }
+
+  function nav() {
+      window.location.href = 'resources/gesture-before-onload-target.html#2';
+  }
+
+  function onload() {
+      window.console.log('FAIL: Should not have reached onload before navigating away');
+  }
+</script>
+
diff --git a/LayoutTests/fast/history/history-length.html b/LayoutTests/fast/history/history-length.html
@@ -8,30 +8,34 @@
       layoutTestController.waitUntilDone();
     }
   }
-  // This test advances history by 2 pages, then navigates back one, and
-  // records history.length.  We expect history.length to indicate the total
-  // length of session history.  At the end of the test, it should be 2 greater
-  // than it was at the start of the test.
-  switch (sessionStorage.testStage++) {
-  case 0:
-    sessionStorage.initialLength = history.length;
-    location = "?a";
-    break;
-  case 1:
-    location = "?b";
-    break;
-  case 2:
-    history.back();
-    break;
-  case 3:
-    if (history.length == (sessionStorage.initialLength - 0) + 2)
-      document.body.innerHTML = "PASS";
-    else
-      document.body.innerHTML = "FAIL: initialLength=" + sessionStorage.initialLength + ", history.length=" + history.length;
-    if (window.layoutTestController)
-      layoutTestController.notifyDone();
-    break;
-  }
+
+  // Location changes need to happen outside the onload handler to generate history entries.
+  setTimeout(function() {
+    // This test advances history by 2 pages, then navigates back one, and
+    // records history.length.  We expect history.length to indicate the total
+    // length of session history.  At the end of the test, it should be 2 greater
+    // than it was at the start of the test.
+    switch (sessionStorage.testStage++) {
+    case 0:
+      sessionStorage.initialLength = history.length;
+      location = "?a";
+      break;
+    case 1:
+      location = "?b";
+      break;
+    case 2:
+      history.back();
+      break;
+    case 3:
+      if (history.length == (sessionStorage.initialLength - 0) + 2)
+        document.body.innerHTML = "PASS";
+      else
+        document.body.innerHTML = "FAIL: initialLength=" + sessionStorage.initialLength + ", history.length=" + history.length;
+      if (window.layoutTestController)
+        layoutTestController.notifyDone();
+      break;
+    }
+  }, 0);
 }
 onunload = function() {
   // disable page cache