New issue
Advanced search Search tips

Issue 757616 link

Starred by 2 users

Issue metadata

Status: Available
Owner: ----
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: iOS
Pri: 3
Type: Task



Sign in to add a comment

js_compile_checked code splitting option can break page script injection

Project Member Reported by danyao@chromium.org, Aug 21 2017

Issue description

Chrome Version (from "Settings > About Google Chrome"): All recent versions
Device Type: All

Closure compiler automatically generates ES6 polyfills when compiling JavaScript files that make use of ES6 features. The polyfill is injected as a $jscomp global object at the beginning of the output JS file.

js_compile_checked build rule uses the code splitting feature of Closure compiler (i.e. --module flag). As a result, if the input JS file uses ES6 features, the $jscomp object is only injected into the first module in the dependency chain (i.e. base_module.js), and not the component-specific JS file. This creates a problem because the convention is to only load the component-specific JS file into WKWebView, and assume its dependencies have already been injected via //ios/web:web_bundle.

This issue is discovered in the Credential Management polyfill (crrev.com/c/624166).

How to reproduce:
- Apply the attached patch to a bling checkout (git apply demo.patch)
- Run chrome in iOS Simulator
- Load any web page

Expected result:
Alert "You should see this."

Actual result:
No alert is fired.
If you open Web Inspector (Safari -> Develop -> Simulator -> select your web view), then reload. You should see "ReferenceError: can't find $jscomp" in console.

Now update ios/chrome/browser/web/BUILD.gn to change the "es6test" target from a js_compile_checked to a js_compile_unchecked rule. The alert fires when repeating the steps from above.
 
demo.patch
2.0 KB Download

Comment 1 by danyao@chromium.org, Aug 21 2017

The attached script reproduces the build command of js_compile_checked. Run it in ~/bling/src, and you can examine the output files in ~/bling/src/es6_test_gen. Notice that the definition of $jscomp is in es6_test_gen/base_module.js, and $jscomp.initSymbol is used in es6_test_gen/es6test.js.

==

To see the compiled output of js_compile_unchecked, run the following:

java -jar third_party/closure_compiler/compiler/compiler.jar \
--compilation_level SIMPLE_OPTIMIZATIONS \
--js ios/chrome/browser/web/resources/es6test.js \
--js_output_file unchecked_output.js

Notice that both the definition of $jscomp and the usage of $jscomp.initSymbol are in unchecked_output.js.
repro_js_compile_checked.sh
1.2 KB View Download
Labels: -Type-Bug Type-Task
Project Member

Comment 3 by bugdroid1@chromium.org, Aug 23 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/75cd9d9a6744e629e9a534170cb5bd0ece47bb85

commit 75cd9d9a6744e629e9a534170cb5bd0ece47bb85
Author: Tomasz Garbus <tgarbus@chromium.org>
Date: Wed Aug 23 19:00:36 2017

Changed js_compile_checked("payment_request") back to unchecked.

The reason for this change is that in one of my previous CLs
(https://chromium-review.googlesource.com/c/587190) I changed
js_compile_unchecked("payment_request") to
js_compile_checked("payment_request"), as the Closure compiler didn't
throw any errors/warnings for this file. In fact, it is important that
this file is added to BUILD.gn with 'js_compile_unchecked' macro, what
can be verified by running the IDL tests:
https://w3c-test.org/payment-request/interfaces.https.html

Change from 'js_compile_unchecked' to 'js_compile_checked' resulted
in 7 more failed tests.

'js_compile_checked' breaks the injected code because it inserts
|$jscomp.initSymbol| to the injected code but doesn't insert definition
of this function to the file. This is described more deeply
here: crbug.com/757616

Bug: 587995,757616
Change-Id: I344bb80628b3b348b0e03daa8ab2b28bfa0813fd
Reviewed-on: https://chromium-review.googlesource.com/624166
Commit-Queue: Tomasz Garbus <tgarbus@chromium.org>
Reviewed-by: Vasilii Sukhanov <vasilii@chromium.org>
Reviewed-by: Eugene But <eugenebut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#496759}
[modify] https://crrev.com/75cd9d9a6744e629e9a534170cb5bd0ece47bb85/ios/chrome/browser/web/BUILD.gn

Project Member

Comment 4 by sheriffbot@chromium.org, Aug 24

Labels: Hotlist-Recharge-Cold
Status: Untriaged (was: Available)
This issue has been Available for over a year. If it's no longer important or seems unlikely to be fixed, please consider closing it out. If it is important, please re-triage the issue.

Sorry for the inconvenience if the bug really should have been left as Available.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Status: Available (was: Untriaged)
Components: Mobile>iOSWeb
Components: -Mobile>WebView>Glue
Cc: michaeldo@chromium.org
Components: -Mobile>iOSWeb Mobile>iOSWeb>ScriptInjections

Sign in to add a comment