From ae1f6e6c5e92feaccb3f0684dcd131a79750485b Mon Sep 17 00:00:00 2001
From: Timothy Gu <timothygu@chromium.org>
Date: Thu, 17 Jun 2021 13:58:03 -0700
Subject: [PATCH] Replace unpaired surrogates in result of javascript URLs

Given a URL like javascript:String.fromCodePoint(0xDE0D), Chrome
currently displays three U+FFFD replacement characters rather than just
one, due to the incorrect UTF-8 conversion mode. We fix that by using
kStrictUTF8ConversionReplacingUnpairedSurrogatesWithFFFD.

This CL fully implements https://github.com/whatwg/html/pull/6781.
Tests are partially taken from https://github.com/web-platform-tests/wpt/pull/29419.

Co-authored-by: Domenic Denicola <domenic@chromium.org>
Bug: 1221018
Change-Id: Ic1282d0a88eabb40b4d5d8d8c68e040e9a0a938d
---
 ...ipt-url-return-value-handling-dynamic.html | 51 ----------------
 ...turn-value-handling-dynamic.tentative.html | 58 +++++++++++++++++++
 2 files changed, 58 insertions(+), 51 deletions(-)
 delete mode 100644 html/browsers/browsing-the-web/navigating-across-documents/javascript-url-return-value-handling-dynamic.html
 create mode 100644 html/browsers/browsing-the-web/navigating-across-documents/javascript-url-return-value-handling-dynamic.tentative.html
diff --git a/html/browsers/browsing-the-web/navigating-across-documents/javascript-url-return-value-handling-dynamic.html b/html/browsers/browsing-the-web/navigating-across-documents/javascript-url-return-value-handling-dynamic.html
deleted file mode 100644
index 0441d174cee07f2..000000000000000
--- a/html/browsers/browsing-the-web/navigating-across-documents/javascript-url-return-value-handling-dynamic.html
+++ /dev/null
@@ -1,51 +0,0 @@
-<!doctype html>
-<meta charset=UTF-8>
-<title>Test javascript URL string return values in direct and indirect (target) frame contexts.</title>
-<script src=/resources/testharness.js></script>
-<script src=/resources/testharnessreport.js></script>
-<div id=log></div>
-<script>
-const testInputs = [
-  [0x41],
-  [0x80,0xFF],
-  [0x80,0xFF,0x100],
-  [0xD83D,0xDE0D],
-  [0xDE0D,0x41]
-];
-testInputs.forEach(input => {
-  const javascriptURL = "javascript:[" + input + "].map(b => String.fromCharCode(b)).join('')",
-        output = input.map(b => String.fromCharCode(b)).join("");
-  async_test(t => {
-    const frame = document.createElement("iframe");
-    t.add_cleanup(() => frame.remove());
-    frame.src = javascriptURL;
-    t.step_timeout(() => {
-      assert_equals(frame.contentDocument.body.textContent, output);
-      assert_equals(frame.contentDocument.charset, document.charset);
-      t.done();
-    }, 200);
-    document.body.appendChild(frame);
-  });
-});
-
-testInputs.forEach(input => {
-  const javascriptURL = "javascript:[" + input + "].map(b => String.fromCharCode(b)).join('')",
-        output = input.map(b => String.fromCharCode(b)).join("");
-  async_test(t => {
-    const frame = document.createElement("iframe"),
-          href = document.createElement("a");
-    t.add_cleanup(() => { frame.remove(); href.remove(); });
-    frame.name = "hi" + input;
-    href.target = "hi" + input;
-    href.href = javascriptURL;
-    t.step_timeout(() => {
-      assert_equals(frame.contentDocument.body.textContent, output);
-      assert_equals(frame.contentDocument.charset, document.charset);
-      t.done();
-    }, 200)
-    document.body.appendChild(frame);
-    document.body.appendChild(href);
-    href.click();
-  });
-});
-</script>
diff --git a/html/browsers/browsing-the-web/navigating-across-documents/javascript-url-return-value-handling-dynamic.tentative.html b/html/browsers/browsing-the-web/navigating-across-documents/javascript-url-return-value-handling-dynamic.tentative.html
new file mode 100644
index 000000000000000..3c08d29674bdc2d
--- /dev/null
+++ b/html/browsers/browsing-the-web/navigating-across-documents/javascript-url-return-value-handling-dynamic.tentative.html
@@ -0,0 +1,58 @@
+<!doctype html>
+<meta charset=windows-1252> <!-- intentionally not UTF-8 to test that the javascript: frames are forced to UTF-8 -->
+<title>Test javascript URL string return values in direct and indirect (target) frame contexts.</title>
+<!-- Waiting on https://github.com/whatwg/html/pull/6781 to be non-tentative. -->
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<div id=log></div>
+<script>
+const testCases = [
+  [[0x41]],
+  [[0x80,0xFF]],
+  [[0x80,0xFF,0x100]],
+  [[0xD83D,0xDE0D]],
+  [[0xDE0D,0x41], [0xFFFD,0x41]]
+];
+
+function formatCharCodes(charCodes) {
+  return charCodes.map(code => code.toString(16).toUpperCase().padStart(4, '0')).join(" ");
+}
+
+for (const [input, expected = input] of testCases) {
+  const javascriptURL = `javascript:String.fromCharCode(${input})`;
+  const output = String.fromCharCode(...expected);
+
+  async_test(t => {
+    const frame = document.createElement("iframe");
+    t.add_cleanup(() => frame.remove());
+    frame.src = javascriptURL;
+
+    t.step_timeout(() => {
+      assert_equals(frame.contentDocument.body.textContent, output);
+      assert_equals(frame.contentDocument.charset, "UTF-8");
+      t.done();
+    }, 200);
+
+    document.body.appendChild(frame);
+  }, `${formatCharCodes(input)} set in src=""`);
+
+  async_test(t => {
+    const frame = document.createElement("iframe");
+    const href = document.createElement("a");
+    t.add_cleanup(() => { frame.remove(); href.remove(); });
+    frame.name = "hi" + input;
+    href.target = "hi" + input;
+    href.href = javascriptURL;
+
+    t.step_timeout(() => {
+      assert_equals(frame.contentDocument.body.textContent, output);
+      assert_equals(frame.contentDocument.charset, "UTF-8");
+      t.done();
+    }, 200)
+
+    document.body.appendChild(frame);
+    document.body.appendChild(href);
+    href.click();
+  }, `${formatCharCodes(input)} set in href="" targeting a frame and clicked`);
+}
+</script>
