Bug 1563629 - Inherit TabContext values from the current BrowserParent, r=nika,kmag

Differential Revision: https://phabricator.services.mozilla.com/D37618

--HG--
extra : moz-landing-system : lando

dom/ipc/BrowserBridgeParent.cpp

@@ -38,15 +38,16 @@ nsresult BrowserBridgeParent::Init(const nsString& aPresentationURL,
                                    const uint32_t& aChromeFlags, TabId aTabId) {
   mIPCOpen = true;
 
-  // FIXME: This should actually use a non-bogus TabContext, probably inherited
-  // from our Manager().
-  OriginAttributes attrs;
-  attrs.mInIsolatedMozBrowser = false;
-  attrs.SyncAttributesWithPrivateBrowsing(false);
-  uint32_t maxTouchPoints = Manager()->GetMaxTouchPoints();
+  // We can inherit most TabContext fields for the new BrowserParent actor from
+  // our Manager BrowserParent.
+  //
+  // We don't intend to support mozbrowsers with Fission currently, so we set
+  // |aMozBrowserElement| to be false.
   MutableTabContext tabContext;
-  tabContext.SetTabContext(false, 0, UIStateChangeType_Set, attrs,
-                           aPresentationURL, maxTouchPoints);
+  tabContext.SetTabContext(false, Manager()->ChromeOuterWindowID(),
+                           Manager()->ShowFocusRings(),
+                           Manager()->OriginAttributesRef(), aPresentationURL,
+                           Manager()->GetMaxTouchPoints());
 
   ProcessPriority initialPriority = PROCESS_PRIORITY_FOREGROUND;
 

dom/tests/browser/browser.ini

@@ -36,6 +36,9 @@ skip-if = os != "mac"
 [browser_bug1238427.js]
 [browser_bug1316330.js]
 skip-if = !e10s
+[browser_bug1563629.js]
+support-files =
+  file_postMessage_parent.html
 [browser_cancel_keydown_keypress_event.js]
 support-files =
   prevent_return_key.html

dom/tests/browser/browser_bug1563629.js

@@ -0,0 +1,79 @@
+"use strict";
+
+const DIRPATH = getRootDirectory(gTestPath).replace(
+  "chrome://mochitests/content/",
+  ""
+);
+const PATH = DIRPATH + "file_postMessage_parent.html";
+
+const URL1 = `http://example.com/${PATH}`;
+const URL2 = `http://example.org/${PATH}`;
+
+function listenForCrash(win) {
+  function listener(event) {
+    ok(false, "a crash occurred");
+  }
+
+  win.addEventListener("oop-browser-crashed", listener);
+  registerCleanupFunction(() => {
+    win.removeEventListener("oop-browser-crashed", listener);
+  });
+}
+
+add_task(async function() {
+  let win = await BrowserTestUtils.openNewBrowserWindow({
+    fission: true,
+    private: true,
+    remote: true,
+  });
+
+  listenForCrash(win);
+
+  try {
+    let tab = win.gBrowser.selectedTab;
+    let browser = tab.linkedBrowser;
+
+    BrowserTestUtils.loadURI(browser, URL1);
+    await BrowserTestUtils.browserLoaded(browser, false, URL1);
+
+    async function loadURL(url) {
+      let iframe = content.document.createElement("iframe");
+      content.document.body.appendChild(iframe);
+
+      iframe.contentWindow.location = url;
+      await new Promise(resolve =>
+        iframe.addEventListener("load", resolve, { once: true })
+      );
+
+      return iframe.browsingContext;
+    }
+
+    function length() {
+      return content.length;
+    }
+
+    let outer = await SpecialPowers.spawn(browser, [URL2], loadURL);
+    let inner = await SpecialPowers.spawn(outer, [URL2], loadURL);
+
+    is(await SpecialPowers.spawn(outer, [], length), 1, "have 1 inner frame");
+    is(await SpecialPowers.spawn(browser, [], length), 1, "have 1 outer frame");
+
+    // Send a message from the outer iframe to the inner one.
+    //
+    // This would've previously crashed the content process that URL2 is running
+    // in.
+    await SpecialPowers.spawn(outer, [], () => {
+      content.frames[0].postMessage("foo", "*");
+    });
+
+    // Now send a message from the inner frame to the outer one.
+    await SpecialPowers.spawn(inner, [], () => {
+      content.parent.postMessage("bar", "*");
+    });
+
+    // Assert we've made it this far.
+    ok(true, "didn't crash");
+  } finally {
+    await BrowserTestUtils.closeWindow(win);
+  }
+});