Custom Element constructors should synchronously invoke the ready callback

Custom Element constructors should synchronously invoke the ready callback

BUG=238578
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=149919

[eseidel, 2013-05-07 08:24:18]

So now any element creation causes syncrhonous javascript execution?  (obviously
not from this patch but from custom elements?)

[dominicc (has gone to gerrit), 2013-05-07 11:42:19]

On 2013/05/07 08:24:18, Eric Seidel (Google) wrote:
> So now any element creation causes syncrhonous javascript execution? 
(obviously
> not from this patch but from custom elements?)

Short answer: Yes, but...

Long answer:

I know how synchronously running JavaScript leads to reentrancy the
implementation doesn't expect and security bugs result. Authors love synchronous
callbacks because they can register a custom element on line n and use the API
on an element on line n+1. So how we meet both requirements is by adding the
callbacks to a work list while Blink is running C++, and running the callbacks
when we are about to return to JavaScript.

Our argument is that because we're not running the JavaScript on an arbitrary
callstack deep in the parser or whatever, but at a point when the author is
about to be able to run JavaScript anyway, this won't have any onerous security
implication. And from the author's perspective the callback is synchronous.

The code that delivers the callback could be sequestered into its own tiny class
so we can give it lots of scrutiny. I plan on doing that.

Apart from this constructor, which uses CallbackDeliveryScope by hand, you can
see how this works by grepping for DeliverCustomElementCallbacks. It is an IDL
attribute morrita implemented. Added to anything that may add callbacks to the
work list (like innerHTML, etc.) it triggers code generation to run the
callbacks right before returning to script.

I am writing up a post-hoc design doc about how this works.

[abarth-chromium, 2013-05-07 16:22:53]

On 2013/05/07 11:42:19, dominicc wrote:
> I am writing up a post-hoc design doc about how this works.

Sounds complicated.  A design doc would be helpful.

We definitely can't run JavaScript synchronously from createElement and be
secure.  It's not clear to me how you'll know which APIs to annotate with
[DeliverCustomElementCallbacks].  What are the consequences of forgetting that
IDL attribute?

[dglazkov, 2013-05-07 16:33:01]

The title of the patch is a bit too harsh :)

The callbacks aren't delivered synchronously in all cases. Per spec
(https://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/custom/index.html#cust...),
they are only synchronous for the case of document.createElement('foo-bar') and
new FooBar()
(https://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/custom/index.html#dfn-...)

Since CustomElementConstructor::createElement is only called from
V8CustomElementConstructorCustom, this patch is not doing anything dangerous.

[dglazkov, 2013-05-07 16:36:59]

LGTM, though we still need to address the document.createElement case.

[commit-bot: I haz the power, 2013-05-07 23:23:58]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/dominicc@chromium.org/14711003/1

[commit-bot: I haz the power, 2013-05-08 00:05:41]

Change committed as 149919