IME extension seems broken for cross origin frames. |
||||
Issue descriptionChrome Version: 58.0.3013.0 (Official Build) canary (64-bit) OS: Mac OSX What steps will reproduce the problem? (1) Open Chrome and install the Google Input Tools extension (https://chrome.google.com/webstore/detail/google-input-tools/mclkkofklkfljcocdinagocijmpgbhab?hl=en) (2) Navigate to a page with a same-origin iframe which has an editable area. (3) Click on the extension;s button and then select Emoji and Symbols to show the virtual keyboard. (4) Click on some symbol, say '@'. (5) Note that it appears inside the <input> (6) Now make the <iframe> cross origin and repeat (3) and (4). What is the expected result? The inserted character appear in the <input>. What happens instead? The inserted character does not appear in the <input>. Interestingly, by navigating the same frame back to the same origin location, the IME still won't work. I could repro the exact same behavior on stable (56.0.2924.87) and beta channels (57.0.2987.37).
,
Feb 15 2017
Yes. This is not related to OOPIF at least (I had the flag disabled for testing in the repro steps). 1) I am not quite sure what "legacy version" is. Is this something I should find in chrome://extensions and in the Goolge Input Tools options? 2) It is enabled (69bf80fa-3f4a17df = SiteIsolationExtensions-Enabled) on Canary and beta. I can check it for stable later today. 3) I don't see any frames when trying http://csreis.github.io/tests/cross-site-iframe-simple.html I also suspect it has to do with the extension itself. I just can't understand how the cross origin frame case won't work when we are not in OOPIF. Maybe some APIs get blocked? cc-ing shuchen@ for more input since this could be an IME extension/API(?) issue.
,
Feb 15 2017
@comment 2: Thanks. I mentioned the OOPIF aspect because lots of the OOPIF modes could have been related (SiteIsolationExtensions, --site-per-process, --top-document-isolation, and the webview-OOPIF trial). Looks like none of them are to blame. 1) Click the "Extension options" menu item in the IME extension's browser action (popup menu), and you'll see a legacy version option. I'm guessing you have it enabled, which wasn't the default for me. 2) Yep-- we have that mode on for 90% of Canary/Dev, 50% of Beta, and now 50% of Stable. I suspect you'll see some subframe processes in Task Manager when it's on, but the bug repros for me even when it's off. You can force disable it with --force-fieldtrials=SiteIsolationExtensions/Control 3) On http://csreis.github.io/tests/cross-site-iframe-simple.html, the gray area with all the form fields is an iframe. Anyway, sounds like this is most likely a bug in the extension. I could imagine that they inject code into the main frame that tries to interact with all the frames, and that would be prevented from reaching cross-origin iframes by the Same Origin Policy. You might try testing it against an old version of Chrome (something like M50 or M52) to see if it was broken before. If so, this should probably be WontFixed and we can file an internal bug for the extension itself. Thanks!
,
Feb 15 2017
Thanks. 1) I was trying options before. But I just noticed the checkbox for legacy version appears for a split second after I go to options and then the page is replaced with the keyboard and languages options. 2) Thanks. 3) Yes. I do usually use that URL for testing OOPIFs. By not seeing any frames I was referring to the task manager. Another hint at the problem being the extension itself. I will try older older versions and update this bug.
,
Feb 17 2017
Based on comment #4, assigning to Ehsan for now to move this bug out of triage queue.
,
Mar 15 2017
Sorry it took me a while. I tested this on Chrome 48 and it failed on cross origin content. Following comment #3 I will close this issue. |
||||
►
Sign in to add a comment |
||||
Comment 1 by creis@chromium.org
, Feb 15 2017Components: Internals>Sandbox>SiteIsolation
Labels: OS-Chrome OS-Linux OS-Windows