Bug 1228754, r=mak,bz

MozReview-Commit-ID: IGGW2RGiN3u

--HG--
extra : rebase_source : a724f7dd9f7437affada8c308af3da619fd72fdc

browser/base/content/browser.js

@@ -2341,10 +2341,12 @@ function URLBarSetURI(aURI) {
     // 2. if remote newtab is enabled and it's the default remote newtab page
     let defaultRemoteURL = gAboutNewTabService.remoteEnabled &&
                            uri.spec === gAboutNewTabService.newTabURL;
-    if (gInitialPages.includes(uri.spec) || defaultRemoteURL)
-      value = gBrowser.selectedBrowser.hasContentOpener ? uri.spec : "";
-    else
+    if ((gInitialPages.includes(uri.spec) || defaultRemoteURL) &&
+        checkEmptyPageOrigin(gBrowser.selectedBrowser, uri)) {
+      value = "";
+    } else {
       value = losslessDecodeURI(uri);
+    }
 
     valid = !isBlankPageURL(uri.spec);
   }
@@ -4324,7 +4326,7 @@ var XULBrowserWindow = {
     // Do not update urlbar if there was a subframe navigation
 
     if (aWebProgress.isTopLevel) {
-      if ((location == "about:blank" && !gBrowser.selectedBrowser.hasContentOpener) ||
+      if ((location == "about:blank" && checkEmptyPageOrigin()) ||
           location == "") {  // Second condition is for new tabs, otherwise
                              // reload function is enabled until tab is refreshed.
         this.reloadCommand.setAttribute("disabled", "true");
@@ -6393,7 +6395,7 @@ function isTabEmpty(aTab) {
   if (!isBlankPageURL(browser.currentURI.spec))
     return false;
 
-  if (browser.hasContentOpener)
+  if (!checkEmptyPageOrigin(browser))
     return false;
 
   if (browser.canGoForward || browser.canGoBack)
@@ -6402,6 +6404,53 @@ function isTabEmpty(aTab) {
   return true;
 }
 
+/**
+ * Check whether a page can be considered as 'empty', that its URI
+ * reflects its origin, and that if it's loaded in a tab, that tab
+ * could be considered 'empty' (e.g. like the result of opening
+ * a 'blank' new tab).
+ *
+ * We have to do more than just check the URI, because especially
+ * for things like about:blank, it is possible that the opener or
+ * some other page has control over the contents of the page.
+ *
+ * @param browser {Browser}
+ *        The browser whose page we're checking (the selected browser
+ *        in this window if omitted).
+ * @param uri {nsIURI}
+ *        The URI against which we're checking (the browser's currentURI
+ *        if omitted).
+ *
+ * @return false if the page was opened by or is controlled by arbitrary web
+ *         content, unless that content corresponds with the URI.
+ *         true if the page is blank and controlled by a principal matching
+ *         that URI (or the system principal if the principal has no URI)
+ */
+function checkEmptyPageOrigin(browser = gBrowser.selectedBrowser,
+                              uri = browser.currentURI) {
+  // If another page opened this page with e.g. window.open, this page might
+  // be controlled by its opener - return false.
+  if (browser.hasContentOpener) {
+    return false;
+  }
+  let contentPrincipal = browser.contentPrincipal;
+  if (gMultiProcessBrowser && browser.isRemoteBrowser &&
+      !contentPrincipal && uri.spec == "about:blank") {
+    // Need to specialcase this because of how stopping an about:blank
+    // load from chrome on e10s causes a permanently null contentPrincipal,
+    // see bug 1249362.
+    return true;
+  }
+  // Not all principals have URIs...
+  if (contentPrincipal.URI) {
+    return contentPrincipal.URI.equals(uri);
+  }
+  // ... so for those that don't have them, enforce that the page has the
+  // system principal (this matches e.g. on about:blank).
+  let ssm = Services.scriptSecurityManager;
+  return ssm.isSystemPrincipal(contentPrincipal);
+}
+
 function BrowserOpenSyncTabs() {
   if (Services.prefs.getBoolPref("services.sync.syncedTabsUIRefresh")) {
     gSyncUI.openSyncedTabsPanel();

browser/base/content/test/urlbar/browser.ini

@@ -0,0 +1,3 @@
+[browser_urlbar_blanking.js]
+support-files =
+  file_blank_but_not_blank.html

browser/base/content/test/urlbar/browser_urlbar_blanking.js

@@ -0,0 +1,35 @@
+"use strict";
+
+add_task(function*() {
+  for (let page of gInitialPages) {
+    if (page == "about:newtab") {
+      // New tab preloading makes this a pain to test, so skip
+      continue;
+    }
+    let tab = yield BrowserTestUtils.openNewForegroundTab(gBrowser, page);
+    ok(!gURLBar.value, "The URL bar should be empty if we load a plain " + page + " page.");
+    yield BrowserTestUtils.removeTab(tab);
+  }
+});
+
+add_task(function*() {
+  const URI = "http://www.example.com/browser/browser/base/content/test/urlbar/file_blank_but_not_blank.html";
+  let tab = yield BrowserTestUtils.openNewForegroundTab(gBrowser, URI);
+  is(gURLBar.value, URI, "The URL bar should match the URI");
+  let browserLoaded = BrowserTestUtils.browserLoaded(tab.linkedBrowser);
+  ContentTask.spawn(tab.linkedBrowser, null, function() {
+    content.document.querySelector('a').click();
+  });
+  yield browserLoaded;
+  ok(gURLBar.value.startsWith("javascript"), "The URL bar should have the JS URI");
+  // When reloading, the javascript: uri we're using will throw an exception.
+  // That's deliberate, so we need to tell mochitest to ignore it:
+  SimpleTest.expectUncaughtException(true);
+  yield ContentTask.spawn(tab.linkedBrowser, null, function*() {
+    // This is sync, so by the time we return we should have changed the URL bar.
+    content.location.reload();
+  });
+  ok(!!gURLBar.value, "URL bar should not be blank.");
+  yield BrowserTestUtils.removeTab(tab);
+  SimpleTest.expectUncaughtException(false);
+});

browser/base/content/test/urlbar/file_blank_but_not_blank.html

@@ -0,0 +1,2 @@
+<script>var q = 1;</script>
+<a href="javascript:q">Click me</a>

browser/base/moz.build

@@ -23,6 +23,7 @@ BROWSER_CHROME_MANIFESTS += [
     'content/test/popupNotifications/browser.ini',
     'content/test/referrer/browser.ini',
     'content/test/social/browser.ini',
+    'content/test/urlbar/browser.ini',
 ]
 
 DEFINES['MOZ_APP_VERSION'] = CONFIG['MOZ_APP_VERSION']