New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 679067 link

Starred by 2 users

Issue metadata

Status: Untriaged
Owner: ----
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 3
Type: Bug



Sign in to add a comment

Inconsistent behavior when creating popups from unload handler

Project Member Reported by nick@chromium.org, Jan 6 2017

Issue description

There is an inconsistent behavior around popup creation behavior from unload handlers, that arises now that  bug 627852  is fixed.

1) In new tab (let it be tab1) load http://popuptest.com/popuptest2.html
2) Allow the browser to show multiple popups for this page (by interacting with the popup icon on the right hand side of the omnibox)
3) Re-load the page. You should see one popup appear.
4) Note that this page's unload handler will try to open a second popup window.

Now unload the document via one of the following methods:
5a) close the tab
5b) do a same-site navigation (by click the 'Reload' button)
5c) do a cross-site navigation (type 'www.google.com' into the omnibox).

Expected behavior: 5a, 5b and 5c to all consistently show or suppress the popup in this case.

Actual behavior: the popup is allowed in case 5a and 5b, but suppressed in case 5c.

The suppression in 5c happens because of a "(frame_tree_node_->current_frame_host() == this)" check in RenderFrameHostImpl::OnCreateNewWindow. Prior to r441781, we would actually kill the process in this case -- that was  bug 627852 .

The process kill was added as part of a fix for a security bug: https://codereview.chromium.org/92873004/diff/200001/content/browser/web_contents/web_contents_impl.cc#newcode1280. That intervention was something of a blunt hammer, since at the time rph_id wasn't properly plumbed into the window creation calls. 

So, it might be possible to securely allow popup creation in case 5c today, though suppressing popups in cases 5b (and especially 5a) should be explored too, since popups are pretty user hostile.
 
Project Member

Comment 1 by sheriffbot@chromium.org, Feb 15 2018

Labels: Hotlist-Recharge-Cold
Status: Untriaged (was: Available)
This issue has been Available for over a year. If it's no longer important or seems unlikely to be fixed, please consider closing it out. If it is important, please re-triage the issue.

Sorry for the inconvenience if the bug really should have been left as Available. If you change it back, also remove the "Hotlist-Recharge-Cold" label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment