Chromium Code Reviews Chromium Code Reviews
Issue 112203003:
Fix renderer crashes when frame gets detached while injectng user scripts. (Closed)
Base URL: https://chromium.googlesource.com/chromium/src.git@master| Index: content/renderer/render_view_browsertest.cc |
| diff --git a/content/renderer/render_view_browsertest.cc b/content/renderer/render_view_browsertest.cc |
| index 92d8fccb88e1ea6dc6ce81bf81d33b1e4dbc2788..092d0b295e0ee082c1548d6ff4b8e8263b9238e8 100644 |
| --- a/content/renderer/render_view_browsertest.cc |
| +++ b/content/renderer/render_view_browsertest.cc |
| @@ -36,6 +36,7 @@ |
| #include "third_party/WebKit/public/web/WebFrame.h" |
| #include "third_party/WebKit/public/web/WebHistoryItem.h" |
| #include "third_party/WebKit/public/web/WebRuntimeFeatures.h" |
| +#include "third_party/WebKit/public/web/WebScriptSource.h" |
| #include "third_party/WebKit/public/web/WebView.h" |
| #include "third_party/WebKit/public/web/WebWindowFeatures.h" |
| #include "ui/events/keycodes/keyboard_codes.h" |
| @@ -2150,4 +2151,55 @@ TEST_F(RenderViewImplTest, SendCandidateWindowEvents) { |
| EXPECT_EQ(output, "\nResult:showupdatehide"); |
| } |
| +class SynchronousFrameRemovalOnLoadTest : public RenderViewImplTest { |
| + protected: |
| + // Helper render view observer class that tries to remove |
| + // element with id 'frame' from top frame/document DOM |
| + // when non-top frame finishes loading. |
| + class OnLoadFrameRemover : public RenderViewObserver { |
| + public: |
| + OnLoadFrameRemover(RenderView* render_view) : |
|
jamesr
2014/01/15 18:56:14
one argument constructors must be marked explicit
|
| + RenderViewObserver(render_view) {} |
| + virtual ~OnLoadFrameRemover() {} |
| + |
| + virtual void DidFinishDocumentLoad(blink::WebFrame* frame) { |
|
jamesr
2014/01/15 18:56:14
if this is overriding a function from RenderViewOb
|
| + if (frame->top() != frame) { |
| + frame->top()->executeScript(blink::WebScriptSource( |
| + WebString::fromUTF8( |
| + "document.getElementById('frame').remove();"))); |
| + } |
| + } |
| + }; |
| +}; |
| + |
| +// Tests if synchronously removing a frame on its load does not cause crashes. |
| +TEST_F(SynchronousFrameRemovalOnLoadTest, DynamicallyInsertedFrame) { |
| + OnLoadFrameRemover remover(view()); |
| + LoadHTML("<html>" |
| + "<head>" |
| + "<title></title>" |
| + "<script type='text/javascript' language='javascript'>" |
| + "window.onload = function () {" |
| + " frame = document.createElement('iframe');" |
| + " frame.id = 'frame';" |
| + " document.body.appendChild(frame);" |
| + "}" |
| + "</script>" |
| + "</head>" |
| + "<body></body>" |
| + "</html>"); |
| +} |
| + |
| +TEST_F(SynchronousFrameRemovalOnLoadTest, StaticFrame) { |
| + OnLoadFrameRemover remover(view()); |
| + LoadHTML("<html>" |
| + "<head>" |
| + "<title></title>" |
| + "</head>" |
| + "<body>" |
| + "<iframe id='frame' src='about:blank'></iframe>" |
| + "</body>" |
| + "</html>"); |
| +} |
| + |
| } // namespace content |
