New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 692549 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
Closed: Mar 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , Chrome , Mac
Pri: 2
Type: Bug



Sign in to add a comment

IME extension seems broken for cross origin frames.

Project Member Reported by ekaramad@chromium.org, Feb 15 2017

Issue description

Chrome Version: 58.0.3013.0 (Official Build) canary (64-bit)
OS: Mac OSX

What steps will reproduce the problem?
(1) Open Chrome and install the Google Input Tools extension (https://chrome.google.com/webstore/detail/google-input-tools/mclkkofklkfljcocdinagocijmpgbhab?hl=en)
(2) Navigate to a page with a same-origin iframe which has an editable area.
(3) Click on the extension;s button and then select Emoji and Symbols to show the virtual keyboard.
(4) Click on some symbol, say '@'.
(5) Note that it appears inside the <input>
(6) Now make the <iframe> cross origin and repeat (3) and (4).


What is the expected result?
The inserted character appear in the <input>.

What happens instead?
The inserted character does not appear in the <input>.

Interestingly, by navigating the same frame back to the same origin location, the IME still won't work.

I could repro the exact same behavior on stable (56.0.2924.87) and beta channels (57.0.2987.37).
 
repeo_ime_extension_720p.mov
7.7 MB Download

Comment 1 by creis@chromium.org, Feb 15 2017

Cc: rdevlin....@chromium.org nasko@chromium.org
Components: Internals>Sandbox>SiteIsolation
Labels: OS-Chrome OS-Linux OS-Windows
At first glance, this sounds like something that --isolate-extensions or OOPIFs might cause, but that doesn't seem to be the case.

I'm having some trouble with the repro steps, though, so maybe you can help me verify?  A few questions:
1) The video shows a different IME experience than I get when I install the extension linked above.  Did you put it into "legacy version" in the extension settings?
2) Can you check whether you are in the SiteIsolationExtensions variation on chrome://version?  (What's the suffix for "69bf80fa"?)
3) Can you check the Task Manager to see whether you have any Subframe processes?

Note that for step 2, I'm using https://csreis.github.io/tests/cross-site-iframe-simple.html (for a same-origin frame), and for step 6, I'm using http://csreis.github.io/tests/cross-site-iframe-simple.html (for a cross-origin frame).  (The iframe is HTTPS in both cases.)

In my testing on 57.0.2987.37 Beta, I found that the non-legacy IME extension has a lot of input issues whether I am in --isolate-extensions (or any OOPIF mode) or not.  And in the legacy mode, I can repro the behavior you show in the video, even when not in any OOPIF mode.

That suggests to me that it might be a bug in the extension itself?  If so, do you know who we might contact on that team?

Cc: shuchen@chromium.org
Yes. This is not related to OOPIF at least (I had the flag disabled for testing in the repro steps).

1) I am not quite sure what "legacy version" is. Is this something I should find in chrome://extensions and in the Goolge Input Tools options?

2) It is enabled (69bf80fa-3f4a17df = SiteIsolationExtensions-Enabled) on Canary and beta. I can check it for stable later today.

3) I don't see any frames when trying http://csreis.github.io/tests/cross-site-iframe-simple.html

I also suspect it has to do with the extension itself. I just can't understand how the cross origin frame case won't work when we are not in OOPIF. Maybe some APIs get blocked?

cc-ing shuchen@ for more input since this could be an IME extension/API(?) issue.

Comment 3 by creis@chromium.org, Feb 15 2017

@comment 2: Thanks.  I mentioned the OOPIF aspect because lots of the OOPIF modes could have been related (SiteIsolationExtensions, --site-per-process, --top-document-isolation, and the webview-OOPIF trial).  Looks like none of them are to blame.

1) Click the "Extension options" menu item in the IME extension's browser action (popup menu), and you'll see a legacy version option.  I'm guessing you have it enabled, which wasn't the default for me.

2) Yep-- we have that mode on for 90% of Canary/Dev, 50% of Beta, and now 50% of Stable.  I suspect you'll see some subframe processes in Task Manager when it's on, but the bug repros for me even when it's off.  You can force disable it with --force-fieldtrials=SiteIsolationExtensions/Control

3) On http://csreis.github.io/tests/cross-site-iframe-simple.html, the gray area with all the form fields is an iframe.

Anyway, sounds like this is most likely a bug in the extension.  I could imagine that they inject code into the main frame that tries to interact with all the frames, and that would be prevented from reaching cross-origin iframes by the Same Origin Policy.  You might try testing it against an old version of Chrome (something like M50 or M52) to see if it was broken before.  If so, this should probably be WontFixed and we can file an internal bug for the extension itself.  Thanks!
Thanks.

1) I was trying options before. But I just noticed the checkbox for legacy version appears for a split second after I go to options and then the page is replaced with the keyboard and languages options.

2) Thanks.

3) Yes. I do usually use that URL for testing OOPIFs. By not seeing any frames I was referring to the task manager. Another hint at the problem being the extension itself.

I will try older older versions and update this bug.
Owner: ekaramad@chromium.org
Status: Assigned (was: Untriaged)
Based on comment #4, assigning to Ehsan for now to move this bug out of triage queue.
Status: WontFix (was: Assigned)
Sorry it took me a while. I tested this on Chrome 48 and it failed on cross origin content. Following comment #3 I will close this issue.

Sign in to add a comment