New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 769189 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner: ----
Closed: Dec 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug
Team-Security-UX


Show other hotlists

Hotlists containing this issue:
EnamelAndFriendsFixIt


Sign in to add a comment

Race condition between navigation and JS API usage in same-origin iframe

Project Member Reported by raymes@chromium.org, Sep 27 2017

Issue description

Hey site isolation folks, maybe you can help me. I have a same origin iframe:

Frame A: localhost:80
Iframe B: localhost:80

As soon as B loads, it executes a script to obtain geolocation or midi access through the respective JS APIs. However there appears to be a race condition and when these calls get to the browser, queries to RenderFrameHost::GetLastCommittedURL sometimes return an empty string which I assume means that the navigation hasn't made it to the browser yet? Even putting the code in the JS onload handler doesn't appear to fix the issue.

Is this a known issue? Do you have pointers on how to debug this? I can reproduce it fairly reliably on my machine right now.

Thanks!
 

Comment 1 by dcheng@chromium.org, Sep 27 2017

Cc: roc...@chromium.org sa...@chromium.org engedy@chromium.org lukasza@chromium.org
This is a race with the DidCommitProvisionalLoad IPC. The geolocation service [1] is not associated with legacy IPC, so there's no ordering guarantees...

We should try to land engedy's CL to rebind remote interfaces and make sure the binder registry provides the security context at binding to prevent this race.

Comment 3 by nasko@chromium.org, Sep 27 2017

dcheng@, does Mojo queue up requests made on the interface until the impl side of it is bound? I assume yes, but want to double check.

Comment 4 by roc...@chromium.org, Sep 27 2017

Yes, messages are queued on the receiving end of pipe until someone (e.g. a
Binding to an impl) reads them.
Project Member

Comment 5 by bugdroid1@chromium.org, Oct 3 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/0d7cc8b3b2f5145860f3d05020450b0e16db9b40

commit 0d7cc8b3b2f5145860f3d05020450b0e16db9b40
Author: Raymes Khoury <raymes@chromium.org>
Date: Tue Oct 03 23:01:59 2017

Add a temporary hack to fix a race condition with FP layout tests

A race condition means that navigation may not reach the browser process
before a permission request does. This adds a hack to ensure that
navigation has reached the browser by waiting for a cross-origin iframe
to load.

BUG= 689802 , 769189 

Change-Id: I26dba360e322cf31c0ec200985a6908de9a82c35
Reviewed-on: https://chromium-review.googlesource.com/688382
Reviewed-by: Ian Clelland <iclelland@chromium.org>
Commit-Queue: Raymes Khoury <raymes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#506221}
[modify] https://crrev.com/0d7cc8b3b2f5145860f3d05020450b0e16db9b40/third_party/WebKit/LayoutTests/http/tests/resources/feature-policy-permissions-test.js

Components: -Internals>Permissions Internals>Permissions>Model

Comment 7 by est...@chromium.org, Nov 10 2017

Labels: Hotlist-EnamelAndFriendsFixIt

Comment 8 Deleted

Project Member

Comment 10 by bugdroid1@chromium.org, Dec 12 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/090cd7b58fc57101ab9dfe81e2edf276b234ad54

commit 090cd7b58fc57101ab9dfe81e2edf276b234ad54
Author: Raymes Khoury <raymes@chromium.org>
Date: Tue Dec 12 06:40:03 2017

Revert "Add a temporary hack to fix a race condition with FP layout tests"

This reverts commit 0d7cc8b3b2f5145860f3d05020450b0e16db9b40.

Reason for revert: Should be fixed by https://chromium-review.googlesource.com/c/chromium/src/+/735686

Original change's description:
> Add a temporary hack to fix a race condition with FP layout tests
> 
> A race condition means that navigation may not reach the browser process
> before a permission request does. This adds a hack to ensure that
> navigation has reached the browser by waiting for a cross-origin iframe
> to load.
> 
> BUG= 689802 , 769189 
> 
> Change-Id: I26dba360e322cf31c0ec200985a6908de9a82c35
> Reviewed-on: https://chromium-review.googlesource.com/688382
> Reviewed-by: Ian Clelland <iclelland@chromium.org>
> Commit-Queue: Raymes Khoury <raymes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#506221}

TBR=raymes@chromium.org,qyearsley@chromium.org,iclelland@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug:  689802 ,  769189 
Change-Id: I36cd26c2d2683e020237e038f658fb30fe55354d
Reviewed-on: https://chromium-review.googlesource.com/821952
Reviewed-by: Raymes Khoury <raymes@chromium.org>
Reviewed-by: Sam McNally <sammc@chromium.org>
Commit-Queue: Raymes Khoury <raymes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#523358}
[modify] https://crrev.com/090cd7b58fc57101ab9dfe81e2edf276b234ad54/third_party/WebKit/LayoutTests/http/tests/resources/feature-policy-permissions-test.js

Status: Fixed (was: Available)
This was fixed by  https://chromium-review.googlesource.com/c/chromium/src/+/735686

Sign in to add a comment