Don't proceed with same-document history traversals if the destination entry is no longer in the back/forward list

natechapin · chromium-wpt-export-bot · commit bbf5ec116dcd · 2021-10-25T10:42:02.000-07:00
This fix will apply only if AppHistory is enabled, but will apply to *all* preempted same-document history traversals, even if AppHistory hasn't been used at all by the page. AppHistory has the requisite state to detect this case, but the rest of the renderer navigation logic does not. Bug: 1256622 Change-Id: I481067e6e02b61468d604dafcce962a62439a3f8 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3206547 Reviewed-by: Domenic Denicola <domenic@chromium.org> Commit-Queue: Nate Chapin <japhet@chromium.org> Cr-Commit-Position: refs/heads/main@{#934575}
diff --git a/app-history/navigate/forward-to-pruned-entry.html b/app-history/navigate/forward-to-pruned-entry.html
@@ -0,0 +1,31 @@
+<!doctype html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+promise_test(async t => {
+  // Wait for after the load event so that the navigation doesn't get converted
+  // into a replace navigation.
+  await new Promise(resolve => window.onload = () => t.step_timeout(resolve, 0));
+  await appHistory.navigate("#foo").finished;
+  assert_equals(appHistory.entries().length, 2);
+  await appHistory.back().finished;
+  assert_equals(appHistory.current.index, 0);
+
+  // Traverse forward then immediately do a same-document push. This will
+  // truncate the back forward list, and by the time the traverse commits, the
+  // destination key will no longer be present in appHistory.entries(). The
+  // traverse should abort.
+  let forward_value = appHistory.forward();
+  await appHistory.navigate("#clobber").finished;
+  assert_equals(appHistory.current.index, 1);
+  await promise_rejects_dom(t, "AbortError", forward_value.committed);
+  await promise_rejects_dom(t, "AbortError", forward_value.finished);
+
+  // This leaves appHistory.entries() in a consistent state where traversing
+  // back and forward still works.
+  await appHistory.back().finished;
+  assert_equals(appHistory.current.index, 0);
+  await appHistory.forward().finished;
+  assert_equals(appHistory.current.index, 1);
+}, "If forward pruning clobbers the target of a traverse, abort");
+</script>
diff --git a/html/browsers/browsing-the-web/overlapping-navigations-and-traversals/tentative/forward-to-pruned-entry.html b/html/browsers/browsing-the-web/overlapping-navigations-and-traversals/tentative/forward-to-pruned-entry.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+promise_test(async t => {
+  // Wait for after the load event so that the navigation doesn't get converted
+  // into a replace navigation.
+  await new Promise(resolve => window.onload = () => t.step_timeout(resolve, 0));
+  location.hash = "#1";
+  location.hash = "#2";
+  history.go(-2);
+  await new Promise(r => window.onpopstate = r);
+
+  // Traverse forward then immediately do a same-document push. This will
+  // truncate the back forward list.
+  history.forward();
+  location.hash = "#clobber";
+
+  // history.forward() should be aborted.
+  window.onpopstate = t.unreached_func("history.forward() should have been cancelled");
+  await new Promise(r => t.step_timeout(r, 20));
+  assert_equals(location.hash, "#clobber");
+}, "If forward pruning clobbers the target of a traverse, abort");
+
+</script>
