Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Don't always consume user activation for close watchers #10048

Closed
wants to merge 2 commits into from

Conversation

domenic
Copy link
Member

@domenic domenic commented Jan 11, 2024

Closes #10046.

(See WHATWG Working Mode: Changes for more details.)


/interaction.html ( diff )

@domenic domenic requested a review from josepharhar January 11, 2024 02:08
@lukewarlow
Copy link
Member

I'm implementing this in WebKit in a personal capacity there's no official standards position from WebKit yet.

@lukewarlow
Copy link
Member

Fwiw this change makes sense to me

@zcorpan
Copy link
Member

zcorpan commented Jan 16, 2024

My understanding is that this is bug fix to make CloseWatcher work as intended. OK for Mozilla.

@josepharhar
Copy link
Contributor

chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this pull request Jan 17, 2024
This patch tweaks the CloseWatcher user activation checks so that
opening a dialog with user activation does not consume the user
activation to create the CloseWatcher. That way, when the user opens a
dialog element with user activation and then presses escape before
interacting with the page again, the cancel event still gets fired. This
is done in order to address the attached regression bug.

This patch also re-enables CloseWatcher now that the regression bug has
been addressed.

HTML spec PR: whatwg/html#10048

Bug: 1512224
Change-Id: I6f39d538090a832130c40eb30f06041c7a31b741
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this pull request Jan 23, 2024
This patch tweaks the CloseWatcher user activation checks so that
opening a dialog with user activation does not consume the user
activation to create the CloseWatcher. That way, when the user opens a
dialog element with user activation and then presses escape before
interacting with the page again, the cancel event still gets fired. This
is done in order to address the attached regression bug.

This patch also re-enables CloseWatcher now that the regression bug has
been addressed.

HTML spec PR: whatwg/html#10048

Bug: 1512224
Change-Id: I6f39d538090a832130c40eb30f06041c7a31b741
@domenic domenic added the do not merge yet Pull request must not be merged per rationale in comment label Jan 24, 2024
@domenic
Copy link
Member Author

domenic commented Jan 24, 2024

Implementing this in Chromium has uncovered some significant bugs in the anti-abuse logic of close watchers. The new proposed spec allows infinite back-trapping, and the existing spec didn't have enough test coverage. A more significant overhaul will be needed. I think I have something almost working...

@lukewarlow
Copy link
Member

@domenic is there a PR for your overhaul so I can take a look through it? Just wondering how much I'll need to change the draft WebKit implementation

@domenic
Copy link
Member Author

domenic commented Feb 26, 2024

I have a work in progress Chromium CL. This version is passing all the tests but is ugly bad code; this version is my attempt at refactoring but it's now failing some of the tests, so we shouldn't trust it yet. But, it can give you an idea of what I expect the changes to look like:

  • More first-class tracking of close watcher groups, instead of using "is grouped with previous" / "created with user activation".
  • Tracking the amount of allowed groups, in a way that increments / decrements at appropriate points in time.
  • Using those to figure out (a) when creating a new close watcher, whether it goes into the topmost existing group or a new group; (b) whether we can fire the cancel event.

domenic added a commit that referenced this pull request Feb 28, 2024
As noted in #10046, the close watcher anti-abuse measures were overly strict, and would prevent firing the cancel event even when the close watcher was created with user interaction.

Additionally, the "is grouped with previous" infrastructure used to track close watcher groups was buggy, since close watchers could be destroyed and this would cause groups to spuriously collapse.

To fix both of these problems, we re-do the close watcher anti-abuse protections. We now track the groups as a list-of-lists, and explicitly track how many groups should be allowed at a given time. We can then compare them when making decisions about whether to group a new close watcher, or whether to fire a cancel event.

Note that the initial fix proposed in #10046 (and implemented in #10048) is incorrect, as it allows indefinite trapping of the user.

Closes #10046.
@domenic
Copy link
Member Author

domenic commented Feb 28, 2024

Superseded by #10168; any review over there is appreciated!

@domenic domenic closed this Feb 28, 2024
@domenic domenic deleted the close-watcher-swap-steps branch February 28, 2024 06:33
domenic added a commit that referenced this pull request Mar 14, 2024
As noted in #10046, the close watcher anti-abuse measures were overly strict, and would prevent firing the cancel event even when the close watcher was created with user interaction.

Additionally, the "is grouped with previous" infrastructure used to track close watcher groups was buggy, since close watchers could be destroyed and this would cause groups to spuriously collapse.

To fix both of these problems, we re-do the close watcher anti-abuse protections. We now track the groups as a list-of-lists, and explicitly track how many groups should be allowed at a given time. We can then compare them when making decisions about whether to group a new close watcher, or whether to fire a cancel event.

Note that the initial fix proposed in #10046 (and implemented in #10048) is incorrect, as it allows indefinite trapping of the user.

Closes #10046.
rubberyuzu pushed a commit to rubberyuzu/html that referenced this pull request Mar 21, 2024
As noted in whatwg#10046, the close watcher anti-abuse measures were overly strict, and would prevent firing the cancel event even when the close watcher was created with user interaction.

Additionally, the "is grouped with previous" infrastructure used to track close watcher groups was buggy, since close watchers could be destroyed and this would cause groups to spuriously collapse.

To fix both of these problems, we re-do the close watcher anti-abuse protections. We now track the groups as a list-of-lists, and explicitly track how many groups should be allowed at a given time. We can then compare them when making decisions about whether to group a new close watcher, or whether to fire a cancel event.

Note that the initial fix proposed in whatwg#10046 (and implemented in whatwg#10048) is incorrect, as it allows indefinite trapping of the user.

Closes whatwg#10046.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
do not merge yet Pull request must not be merged per rationale in comment topic: close watchers
Development

Successfully merging this pull request may close these issues.

Close watchers: history-action user activation is consumed even for the first close watcher
4 participants