Make WebChannelIPCTransport into a RenderFrameObserver

As of version 63, Chromium creates proxy frames also for the main frame in the
frame tree during cross-process navigations. This leads to a segmentation fault
in WebChannelIPCTransport because we assume that all main frames are local.

See https://crrev.com/27caae83cb530daaf49f9a38793e427cdf493a65 for details.

This patch refactors the renderer-side WebChannelIPCTransport from a
RenderViewObserver into a RenderFrameObserver, which prevents the segmentation
fault since the RenderFrameObserver is not created for proxy frames. Most likely
this would have to be done eventually anyway since the RenderView and
RenderViewObserver classes are deprecated and will likely be removed as part of
the Site Isolation project.

Installation is changed to follow Chromium's RenderFrameImpl in the sense of
performing the installation from RenderFrameObserver::DidClearWindowObject
instead of ContentRendererClient::RunScriptsAtDocumentStart. This has the
benefit of avoiding the ScriptForbiddenScope DCHECK.

Additionally there are the following minor changes:

  - The deprecated parameterless version of v8::Value::ToObject() method is
    replaced with v8::Value::IsObject() check and v8::Local::Cast.

  - The deprecated v8::Handle typedef is replaced with v8::Local.

  - The deprecated single-parameter WebContentsObserver::OnMessageReceived is
    replaced with the new two-parameter version.

  - blink::MainThreadIsolate() is used instead of v8::Isolate::GetCurrent() for
    Install/Uninstall since we know we are executing on the main thread.

  - WebChannelIPCTransportHost is changed to ignore messages from unexpected
    renderers in case something goes wrong with the renderers.

  - Logging is added to WebChannelIPCTransportHost for debugging purposes.

Some new unit tests are added, all of which fail with the old version.

Task-number: QTBUG-66333
Change-Id: I936d142fb042d9f936a3f9d08d4328ecba595f1f
Reviewed-by: Michal Klocek <michal.klocek@qt.io>

1 files changed, 113 insertions, 8 deletions

diff --git a/tests/auto/widgets/qwebenginescript/tst_qwebenginescript.cpp b/tests/auto/widgets/qwebenginescript/tst_qwebenginescript.cpp
index d852ca902..e342632e7 100644
--- a/tests/auto/widgets/qwebenginescript/tst_qwebenginescript.cpp
+++ b/tests/auto/widgets/qwebenginescript/tst_qwebenginescript.cpp
@@ -20,6 +20,7 @@
 #include <QtTest/QtTest>
 
 #include <qwebenginepage.h>
+#include <qwebengineprofile.h>
 #include <qwebenginescript.h>
 #include <qwebenginescriptcollection.h>
 #include <qwebengineview.h>
@@ -39,6 +40,9 @@ private Q_SLOTS:
     void webChannel();
     void noTransportWithoutWebChannel();
     void scriptsInNestedIframes();
+    void webChannelResettingAndUnsetting();
+    void webChannelWithExistingQtObject();
+    void navigation();
 };
 
 void tst_QWebEngineScript::domEditing()
@@ -183,6 +187,27 @@ private:
     QString m_text;
 };
 
+static QString readFile(const QString &path)
+{
+    QFile file(path);
+    file.open(QFile::ReadOnly);
+    QByteArray contents = file.readAll();
+    file.close();
+    return contents;
+}
+
+static QWebEngineScript webChannelScript()
+{
+    QString sourceCode = readFile(QStringLiteral(":/qwebchannel.js"));
+    if (sourceCode.isEmpty())
+        return {};
+
+    QWebEngineScript script;
+    script.setSourceCode(sourceCode);
+    script.setInjectionPoint(QWebEngineScript::DocumentCreation);
+    script.setWorldId(QWebEngineScript::MainWorld);
+    return script;
+}
 
 void tst_QWebEngineScript::webChannel_data()
 {
@@ -204,15 +229,8 @@ void tst_QWebEngineScript::webChannel()
     channel->registerObject(QStringLiteral("object"), &testObject);
     page.setWebChannel(channel.data(), worldId);
 
-    QFile qwebchanneljs(":/qwebchannel.js");
-    QVERIFY(qwebchanneljs.exists());
-    qwebchanneljs.open(QFile::ReadOnly);
-    QByteArray scriptSrc = qwebchanneljs.readAll();
-    qwebchanneljs.close();
-    QWebEngineScript script;
-    script.setInjectionPoint(QWebEngineScript::DocumentCreation);
+    QWebEngineScript script = webChannelScript();
     script.setWorldId(worldId);
-    script.setSourceCode(QString::fromLatin1(scriptSrc));
     page.scripts().insert(script);
     page.setHtml(QStringLiteral("<html><body></body></html>"));
     QSignalSpy spyFinished(&page, &QWebEnginePage::loadFinished);
@@ -300,6 +318,93 @@ void tst_QWebEngineScript::scriptsInNestedIframes()
                 QVariant::fromValue(QStringLiteral("Modified Inner text")));
 }
 
+void tst_QWebEngineScript::webChannelResettingAndUnsetting()
+{
+    QWebEnginePage page;
+
+    // There should be no webChannelTransport yet.
+    QCOMPARE(evaluateJavaScriptSyncInWorld(&page, "qt.webChannelTransport", QWebEngineScript::MainWorld),
+             QVariant(QVariant::Invalid));
+    QCOMPARE(evaluateJavaScriptSyncInWorld(&page, "qt.webChannelTransport", QWebEngineScript::ApplicationWorld),
+             QVariant(QVariant::Invalid));
+
+    QWebChannel channel;
+    page.setWebChannel(&channel, QWebEngineScript::MainWorld);
+
+    // There should be one in MainWorld now.
+    QCOMPARE(evaluateJavaScriptSyncInWorld(&page, "qt.webChannelTransport", QWebEngineScript::MainWorld),
+             QVariant(QVariantMap()));
+    QCOMPARE(evaluateJavaScriptSyncInWorld(&page, "qt.webChannelTransport", QWebEngineScript::ApplicationWorld),
+             QVariant(QVariant::Invalid));
+
+    page.setWebChannel(&channel, QWebEngineScript::ApplicationWorld);
+
+    // Now it should have moved to ApplicationWorld.
+    QCOMPARE(evaluateJavaScriptSyncInWorld(&page, "qt.webChannelTransport", QWebEngineScript::MainWorld),
+             QVariant(QVariant::Invalid));
+    QCOMPARE(evaluateJavaScriptSyncInWorld(&page, "qt.webChannelTransport", QWebEngineScript::ApplicationWorld),
+             QVariant(QVariantMap()));
+
+    page.setWebChannel(nullptr);
+
+    // And now it should be gone again.
+    QCOMPARE(evaluateJavaScriptSyncInWorld(&page, "qt.webChannelTransport", QWebEngineScript::MainWorld),
+             QVariant(QVariant::Invalid));
+    QCOMPARE(evaluateJavaScriptSyncInWorld(&page, "qt.webChannelTransport", QWebEngineScript::ApplicationWorld),
+             QVariant(QVariant::Invalid));
+}
+
+void tst_QWebEngineScript::webChannelWithExistingQtObject()
+{
+    QWebEnginePage page;
+
+    evaluateJavaScriptSync(&page, "qt = 42");
+    QCOMPARE(evaluateJavaScriptSync(&page, "qt.webChannelTransport"), QVariant(QVariant::Invalid));
+
+    QWebChannel channel;
+    page.setWebChannel(&channel);
+
+    // setWebChannel should have overwritten the qt variable
+    QCOMPARE(evaluateJavaScriptSync(&page, "qt.webChannelTransport"), QVariant(QVariantMap()));
+}
+
+static QWebEngineScript locationMonitorScript()
+{
+    QWebEngineScript script = webChannelScript();
+    script.setSourceCode(script.sourceCode() + QStringLiteral(R"(
+        new QWebChannel(qt.webChannelTransport, channel => {
+            channel.objects.object.text = window.location.href;
+        })
+    )"));
+    return script;
+}
+
+void tst_QWebEngineScript::navigation()
+{
+    QWebEnginePage page;
+    TestObject testObject;
+    QSignalSpy spyTextChanged(&testObject, &TestObject::textChanged);
+    QWebChannel channel;
+    channel.registerObject(QStringLiteral("object"), &testObject);
+    page.setWebChannel(&channel);
+    page.scripts().insert(locationMonitorScript());
+
+    QString url1 = QStringLiteral("about:blank");
+    page.setUrl(url1);
+    QTRY_COMPARE(spyTextChanged.count(), 1);
+    QCOMPARE(testObject.text(), url1);
+
+    QString url2 = QStringLiteral("chrome://gpu/");
+    page.setUrl(url2);
+    QTRY_COMPARE(spyTextChanged.count(), 2);
+    QCOMPARE(testObject.text(), url2);
+
+    QString url3 = QStringLiteral("qrc:/resources/test_iframe_main.html");
+    page.setUrl(url3);
+    QTRY_COMPARE(spyTextChanged.count(), 3);
+    QCOMPARE(testObject.text(), url3);
+}
+
 QTEST_MAIN(tst_QWebEngineScript)
 
 #include "tst_qwebenginescript.moc"