// META: script=/common/get-host-info.sub.js
// META: script=/common/utils.js
// META: script=/common/dispatcher/dispatcher.js
//
// This is a regression test for crbug.com/583445. It checks an obscure bug in
// Chromium's handling of `document.open()` whereby the URL change would affect
// the document's origin after a javascript navigation.
//
// See also dcheng@'s comments on the original code review in which he
// introduced the precursor to this test:
// https://codereview.chromium.org/1675473002.

function nextMessage() {
  return new Promise((resolve) => {
    window.addEventListener("message", (e) => { resolve(e.data); }, {
      once: true
    });
  });
}

promise_test(async (t) => {
  // Embed a cross-origin frame A and set up remote code execution.
  const iframeA = document.body.appendChild(document.createElement("iframe"));
  t.add_cleanup(() => { iframeA.remove(); });

  const uuidA = token();
  iframeA.src = remoteExecutorUrl(uuidA, { host: get_host_info().REMOTE_HOST });
  const ctxA = new RemoteContext(uuidA);

  // Frame A embeds a cross-origin frame B, which is same-origin with the
  // top-level frame. Frame B is the center of this test: it is where we will
  // verify that a bug does not grant it UXSS in frame A.
  //
  // Though we could reach into `iframeA.frames[0]` to get a proxy to frame B
  // and use `setTimeout()` like below to execute code inside it, we set up
  // remote code execution using `dispatcher.js` for better ergonomics.
  const uuidB = token();
  await ctxA.execute_script((url) => {
    const iframeB = document.createElement("iframe");
    iframeB.src = url;
    document.body.appendChild(iframeB);
  }, [remoteExecutorUrl(uuidB).href]);

  // Start listening for a message, which will come as a result of executing
  // the code below in frame B.
  const message = nextMessage();

  const ctxB = new RemoteContext(uuidB);
  await ctxB.execute_script(() => {
    // Frame B embeds an `about:blank` frame C.
    const iframeC = document.body.appendChild(document.createElement("iframe"));

    // We wish to execute code inside frame C, but it is important to this test
    // that its URL remain `about:blank`, so we cannot use `dispatcher.js`.
    // Instead we rely on `setTimeout()`.
    //
    // We use `setTimeout(string, ...)` instead of `setTimeout(function, ...)`
    // as the given script executes against the target window's global object
    // and does not capture any local variables.
    //
    // In order to have nice syntax highlighting and avoid quote-escaping hell,
    // we use a trick employed by `dispatcher.js`. We rely on the fact that
    // functions in JS have a stringifier that returns their source code. Thus
    // `"(" + func + ")()"` is a string that executes `func()` when evaluated.
    iframeC.contentWindow.setTimeout("(" + (() => {
      // This executes in frame C.

      // Frame C calls `document.open()` on its parent, which results in B's
      // URL being set to `about:blank` (C's URL).
      //
      // However, just before `document.open()` is called, B schedules a
      // self-navigation to a `javascript:` URL. This will occur after
      // `document.open()`, so the document will navigate from `about:blank` to
      // the new URL.
      //
      // This should not result in B's origin changing, so B should remain
      // same-origin with the top-level frame.
      //
      // Due to crbug.com/583445, this used to behave wrongly in Chromium. The
      // navigation code incorrectly assumed that B's origin should be inherited
      // from its parent A because B's URL was `about:blank`.
      //
      // It is important to schedule this from within the child, as this
      // guarantees that `document.open()` will be called before the navigation.
      // A previous version of this test scheduled this from within frame B
      // right after scheduling the call to `document.open()`, but that ran the
      // risk of races depending on which timeout fired first.
      parent.window.setTimeout("(" + (() => {
        // This executes in frame B.

        location = "javascript:(" + (() => {
          /* This also executes in frame B.
           *
           * Note that because this whole function gets stuffed in a JS URL,
           * single-line comments do not work, as they affect the following
           * lines. */

          let error;
          try {
            /* This will fail with a `SecurityError` if frame B is no longer
             * same-origin with the top-level frame. */
            top.window.testSameOrigin = true;
          } catch (e) {
            error = e;
          }

          top.postMessage({
            error: error?.toString(),
          }, "*");

        }) + ")()";

      }) + ")()", 0);

      // This executes in frame C.
      parent.document.open();

    }) + ")()", 0);
  });

  // Await the message from frame B after its navigation.
  const { error } = await message;
  assert_equals(error, undefined, "error accessing top frame from frame B");
  assert_true(window.testSameOrigin, "top frame testSameOrigin is mutated");

}, "Regression test for crbug.com/583445");