Don't adjust untrusted TouchEvents.

mustaqahmed · Chromium LUCI CQ · commit ab8b71a86e5f · 2021-09-07T18:19:45.000Z
Untrusted touch events are not fired to DOM for whatever reason. But they still go through the adjustment and causes problem when event target is an empty document. We need to fix wpt/touch-events/touch-retargeting.html by avoiding untrusted event dispatch but test_driver doesn't support input to shadow DOM yet. So switched the test to be manual for now. I manually verified that both Chrome and Firefox passes the manual test. Fixed: 1230583 Change-Id: Ia82cbf4a65d859d76180dae063ee7840efb7f3ab Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3094727 Commit-Queue: Mustaq Ahmed <mustaq@chromium.org> Reviewed-by: Robert Flack <flackr@chromium.org> Cr-Commit-Position: refs/heads/main@{#918857}
diff --git a/third_party/blink/renderer/core/events/touch_event.cc b/third_party/blink/renderer/core/events/touch_event.cc
@@ -184,7 +184,8 @@ void TouchEvent::Trace(Visitor* visitor) const {
 }
 
 DispatchEventResult TouchEvent::DispatchEvent(EventDispatcher& dispatcher) {
-  GetEventPath().AdjustForTouchEvent(*this);
+  if (isTrusted())
+    GetEventPath().AdjustForTouchEvent(*this);
   return dispatcher.Dispatch();
 }
 
diff --git a/third_party/blink/renderer/core/events/touch_event_test.cc b/third_party/blink/renderer/core/events/touch_event_test.cc
@@ -11,7 +11,9 @@
 #include "third_party/blink/renderer/core/frame/frame_console.h"
 #include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
+#include "third_party/blink/renderer/core/frame/settings.h"
 #include "third_party/blink/renderer/core/loader/empty_clients.h"
+#include "third_party/blink/renderer/core/script/classic_script.h"
 #include "third_party/blink/renderer/core/testing/page_test_base.h"
 #include "third_party/blink/renderer/platform/instrumentation/use_counter.h"
 #include "third_party/blink/renderer/platform/wtf/vector.h"
@@ -93,6 +95,18 @@ TEST_F(TouchEventTest,
               ElementsAre(mojom::ConsoleMessageSource::kIntervention));
 }
 
+TEST_F(TouchEventTest, DispatchWithEmptyDocTargetDoesntCrash) {
+  String script =
+      "var empty_document = new Document();"
+      "var touch = new Touch({'identifier': 0, 'target': empty_document});"
+      "var touch_event = new TouchEvent('touchmove', {'touches': [touch]});"
+      "document.dispatchEvent(touch_event);";
+
+  GetDocument().GetSettings()->SetScriptEnabled(true);
+  ClassicScript::CreateUnspecifiedScript(ScriptSourceCode(script))
+      ->RunScript(GetDocument().domWindow());
+}
+
 class TouchEventTestNoFrame : public testing::Test {};
 
 TEST_F(TouchEventTestNoFrame, PreventDefaultDoesntRequireFrame) {
diff --git a/third_party/blink/web_tests/NeverFixTests b/third_party/blink/web_tests/NeverFixTests
@@ -1910,6 +1910,9 @@ crbug.com/687225 external/wpt/css/css-counter-styles/ethiopic-numeric/* [ Skip ]
 wpt_internal/document-transition/* [ Skip ]
 virtual/document-transition/wpt_internal/document-transition/* [ Pass ]
 
+# Manual tests in wpt/touch-events
+crbug.com/1247306 external/wpt/touch-events/touch-retargeting-manual.html [ Skip ]
+
 # Tests Linux system font available only in Regular style in Linux set of fonts.
 crbug.com/509989 [ Mac ] virtual/text-antialias/font-synthesis-weight-system-linux.html [ Skip ]
 crbug.com/509989 [ Win ] virtual/text-antialias/font-synthesis-weight-system-linux.html [ Skip ]
diff --git a/third_party/blink/web_tests/external/wpt/touch-events/touch-retargeting-manual.html b/third_party/blink/web_tests/external/wpt/touch-events/touch-retargeting-manual.html
@@ -0,0 +1,36 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>TouchEvent Retargeting Tests</title>
+  <script src="/resources/testharness.js"></script>
+  <script src="/resources/testharnessreport.js"></script>
+</head>
+<body>
+  <h1>Touch retargeting manual test</h1>
+  <div>This test requires touch input.</div>
+  <div id="host"></div>
+</body>
+<script>
+  var host = document.getElementById("host");
+  var root = host.attachShadow({ mode: "open" });
+  var target = document.createElement("h2");
+  target.textContent = "Tap on THIS line of text";
+  root.appendChild(target);
+
+  var test_touch_retargeting = async_test("touch_retargeting");
+
+  on_event(host, "touchstart", e => {
+      test_touch_retargeting.step(() => {
+          assert_equals(e.touches.length, 1, "touches.length is correct");
+          assert_equals(e.touches[0].target, host, "touches[0] is retargeted to host");
+
+          assert_equals(e.targetTouches.length, 1, "targetTouches.length is correct");
+          assert_equals(e.targetTouches[0].target, host, "targetTouches[0] is retargeted to host");
+
+          assert_equals(e.changedTouches.length, 1, "changedTouches.length is correct");
+          assert_equals(e.changedTouches[0].target, host, "changedTouches[0] is retargeted to host");
+      });
+  });
+  on_event(host, "touchend", e => test_touch_retargeting.done());
+</script>
+</html>
diff --git a/third_party/blink/web_tests/external/wpt/touch-events/touch-retargeting.html b/third_party/blink/web_tests/external/wpt/touch-events/touch-retargeting.html

Original file line number	Diff line number	Diff line change
`@@ -184,7 +184,8 @@ void TouchEvent::Trace(Visitor* visitor) const {`
`184`	`184`	`}`
`185`	`185`
`186`	`186`	`DispatchEventResult TouchEvent::DispatchEvent(EventDispatcher& dispatcher) {`
`187`		`- GetEventPath().AdjustForTouchEvent(*this);`
	`187`	`+ if (isTrusted())`
	`188`	`+ GetEventPath().AdjustForTouchEvent(*this);`
`188`	`189`	`return dispatcher.Dispatch();`
`189`	`190`	`}`
`190`	`191`