From ee8ebee4fc3ca028a77dd596d1cf7c9752e4f16e Mon Sep 17 00:00:00 2001
From: Luke Warlow <luke@warlow.dev>
Date: Wed, 20 Sep 2023 12:05:17 +0100
Subject: [PATCH] Add tentative tests for select.showPicker()

---
 .../resources/show-picker-child-iframe.html   | 20 +++++
 ...-picker-cross-origin-iframe.tentative.html | 79 +++++++++++++++++++
 ...ow-picker-disabled-readonly.tentative.html | 22 ++++++
 .../show-picker-user-gesture.tentative.html   | 23 ++++++
 4 files changed, 144 insertions(+)
 create mode 100644 html/semantics/forms/the-select-element/resources/show-picker-child-iframe.html
 create mode 100644 html/semantics/forms/the-select-element/show-picker-cross-origin-iframe.tentative.html
 create mode 100644 html/semantics/forms/the-select-element/show-picker-disabled-readonly.tentative.html
 create mode 100644 html/semantics/forms/the-select-element/show-picker-user-gesture.tentative.html
diff --git a/html/semantics/forms/the-select-element/resources/show-picker-child-iframe.html b/html/semantics/forms/the-select-element/resources/show-picker-child-iframe.html
new file mode 100644
index 00000000000000..247806be0f5fd2
--- /dev/null
+++ b/html/semantics/forms/the-select-element/resources/show-picker-child-iframe.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<title>Test showPicker() in an iframe</title>
+<script type=module>
+const urlParams = new URLSearchParams(location.search);
+const documentDomain = urlParams.get('documentDomain');
+if (documentDomain) {
+  document.domain = documentDomain;
+}
+
+let securityErrors = [];
+const select = document.createElement("select");
+try {
+  select.showPicker();
+} catch (error) {
+  if (error instanceof DOMException && error.name == 'SecurityError') {
+    securityErrors.push("select");
+  }
+}
+parent.postMessage(securityErrors.join(','), "*");
+</script>
diff --git a/html/semantics/forms/the-select-element/show-picker-cross-origin-iframe.tentative.html b/html/semantics/forms/the-select-element/show-picker-cross-origin-iframe.tentative.html
new file mode 100644
index 00000000000000..8c2f09e09a742b
--- /dev/null
+++ b/html/semantics/forms/the-select-element/show-picker-cross-origin-iframe.tentative.html
@@ -0,0 +1,79 @@
+<!DOCTYPE html>
+<title>Test showPicker() called from cross-origin iframe</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<body>
+<iframe id="iframe1"></iframe>
+<iframe id="iframe2"></iframe>
+<iframe id="iframe3"></iframe>
+<iframe id="iframe4"></iframe>
+</body>
+<script>
+function waitForSecurityErrors() {
+  return new Promise((resolve) => {
+    window.addEventListener("message", (event) => resolve(event.data), {
+      once: true,
+    });
+  });
+}
+
+promise_test(async (t) => {
+  iframe1.src =
+    new URL("resources/", self.location).pathname +
+    "show-picker-child-iframe.html";
+
+  // Wait for the iframe to report security errors when calling showPicker().
+  const securityErrors = await waitForSecurityErrors();
+  assert_equals(
+    securityErrors,
+    "",
+    "In same-origin iframes, showPicker() does not throw a SecurityError."
+  );
+});
+
+promise_test(async (t) => {
+  iframe2.src =
+    get_host_info().HTTP_NOTSAMESITE_ORIGIN +
+    new URL("resources/", self.location).pathname +
+    "show-picker-child-iframe.html";
+
+  // Wait for the iframe to report security errors when calling showPicker().
+  const securityErrors = await waitForSecurityErrors();
+  assert_equals(
+    securityErrors,
+    "select",
+    "In cross-origin iframes, showPicker() throws a SecurityError."
+  );
+});
+
+promise_test(async (t) => {
+  iframe3.src =
+    new URL("resources/", self.location).pathname +
+    "show-picker-child-iframe.html?documentDomain=" + get_host_info().ORIGINAL_HOST;
+
+  // Wait for the iframe to report security errors when calling showPicker().
+  const securityErrors = await waitForSecurityErrors();
+  assert_equals(
+    securityErrors,
+    "",
+    "In same-origin but cross-origin-domain iframes, showPicker() does not throw a SecurityError."
+  );
+});
+
+promise_test(async (t) => {
+  document.domain = get_host_info().ORIGINAL_HOST;
+  iframe4.src =
+    get_host_info().HTTP_REMOTE_ORIGIN +
+    new URL("resources/", self.location).pathname +
+    "show-picker-child-iframe.html?documentDomain=" + get_host_info().ORIGINAL_HOST;
+
+  // Wait for the iframe to report security errors when calling showPicker().
+  const securityErrors = await waitForSecurityErrors();
+  assert_equals(
+    securityErrors,
+    "select",
+    "In cross-origin but same-origin-domain iframes, showPicker() throws a SecurityError."
+  );
+});
+</script>
diff --git a/html/semantics/forms/the-select-element/show-picker-disabled-readonly.tentative.html b/html/semantics/forms/the-select-element/show-picker-disabled-readonly.tentative.html
new file mode 100644
index 00000000000000..a68a5b9be9c60e
--- /dev/null
+++ b/html/semantics/forms/the-select-element/show-picker-disabled-readonly.tentative.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<title>Test showPicker() disabled/readonly requirement</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<body></body>
+<script type=module>
+test(() => {
+  const select = document.createElement("select");
+  select.setAttribute("disabled", "");
+
+  assert_throws_dom('InvalidStateError', () => { select.showPicker(); });
+}, 'select showPicker() throws when disabled');
+
+test(() => {
+  const select = document.createElement("select");
+  select.setAttribute("readonly", "");
+
+  assert_throws_dom('InvalidStateError', () => { select.showPicker(); });
+}, 'select showPicker() throws when readonly');
+</script>
diff --git a/html/semantics/forms/the-select-element/show-picker-user-gesture.tentative.html b/html/semantics/forms/the-select-element/show-picker-user-gesture.tentative.html
new file mode 100644
index 00000000000000..2cd624ebbc5499
--- /dev/null
+++ b/html/semantics/forms/the-select-element/show-picker-user-gesture.tentative.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<title>Test showPicker() user gesture requirement</title>
+<meta name="timeout" content="long">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<body></body>
+<script type=module>
+test(() => {
+  const select = document.createElement("select");
+
+  assert_throws_dom('NotAllowedError', () => { select.showPicker(); });
+}, `select showPicker() requires a user gesture`);
+
+promise_test(async t => {
+  const select = document.createElement("select");
+
+  await test_driver.bless('show picker');
+  select.showPicker();
+  select.blur();
+}, `select showPicker() does not throw when user activation is active`);
+</script>
