New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 670507 link

Starred by 2 users

Issue metadata

Status: WontFix
Owner:
Closed: Oct 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Mac
Pri: 3
Type: Bug



Sign in to add a comment

Bad IPC message to password manager with out-of-process iframes enabled

Project Member Reported by est...@chromium.org, Dec 2 2016

Issue description

Chrome Version: 57.0.2938.0 (also reproduced on 55.0.2883.59)
OS: reproduced on Mac and Linux

What steps will reproduce the problem?
(1) Navigate to chrome://flags, enable "Out of process iframes", relaunch Chrome.
(2) Navigate to http://example.com and open DevTools.
(3) In the console, run the following:
var i = document.createElement('iframe');
i.srcdoc = "<input type='password'>";
document.body.appendChild(i)

What is the expected result?
No sad tab

What happens instead?
Sad tab with the following message:
Terminating renderer for bad PasswordManager IPC message, reason 1
 

Comment 1 by nick@chromium.org, Dec 2 2016

Worth noting is that it's not an iframe crash, but a crash in the main process; i.e., there's no oopif here.

Comment 2 by nick@chromium.org, Dec 2 2016

debugged a repro. url comes in as about:srcdoc, so this may be an issue of the renderer needing to send the origin rather  than the url. if so blob and filesystem may also be affected
This also seems to happen with an about:blank iframe and an injected <input>.  But seems to work fine with data: and blob: URLs.

Comment 4 by vabr@chromium.org, Dec 8 2016

Cc: nick@chromium.org
While I could not reproduce on about:blank, I could reproduce on the originally reported example.com.

I see ChildProcessSecurityPolicyImpl::SecurityState::CanAccessDataForOrigin return false after seeing origin_lock_=="http://example.com/" and site_gurl=="about:". This leads to the failed bad message check and renderer kill. I have no idea what the method does, though.

nick@, do you know?

Comment 5 by vabr@chromium.org, Dec 8 2016

Labels: Hotlist-Polish
Marking "Polish" because the effect of this bug is user-visible (and also to get it out of the triaging queue for passwords).

Comment 6 by vabr@chromium.org, Oct 23 2017

Status: WontFix (was: Untriaged)
Seems to work fine on 64.0.3245.0 (GNU/Linux). There is no longer the "Out of process iframes" flag, but I assume this is now the default behaviour? If not, please reopen and try to specify the URL of the flag to use. Thanks!

Comment 7 by creis@chromium.org, Oct 23 2017

Cc: creis@chromium.org
Owner: alex...@chromium.org
The about:flags feature for --site-per-process changed names from "Out of process iframes" to "Strict site isolation" and it's still experimental, but I agree this doesn't repro anymore when it's enabled.  (We're just finishing up a week long trial of having that enabled for a percentage of Canary, FWIW.)

I think it was likely fixed by alexmos@ in r503339 for issue 756587.

Sign in to add a comment