| Index: content/renderer/render_view_browsertest.cc
|
| diff --git a/content/renderer/render_view_browsertest.cc b/content/renderer/render_view_browsertest.cc
|
| index 7ffa3fa224bdf5fc290403450f776f3d1c7a39ab..799dc55b28847c2e05fbe9a81fbd3ab17701c1c8 100644
|
| --- a/content/renderer/render_view_browsertest.cc
|
| +++ b/content/renderer/render_view_browsertest.cc
|
| @@ -36,6 +36,7 @@
|
| #include "third_party/WebKit/public/web/WebFrame.h"
|
| #include "third_party/WebKit/public/web/WebHistoryItem.h"
|
| #include "third_party/WebKit/public/web/WebRuntimeFeatures.h"
|
| +#include "third_party/WebKit/public/web/WebScriptSource.h"
|
| #include "third_party/WebKit/public/web/WebView.h"
|
| #include "third_party/WebKit/public/web/WebWindowFeatures.h"
|
| #include "ui/events/keycodes/keyboard_codes.h"
|
| @@ -2240,4 +2241,57 @@ TEST_F(RenderViewImplTest, FocusElementCallsFocusedNodeChanged) {
|
| render_thread_->sink().ClearMessages();
|
| }
|
|
|
| +class SynchronousFrameRemovalOnLoadTest : public RenderViewImplTest {
|
| + protected:
|
| + // Helper render view observer class that tries to remove
|
| + // element with id 'frame' from top frame/document DOM
|
| + // when non-top frame finishes loading.
|
| + class OnLoadFrameRemover : public RenderViewObserver {
|
| + public:
|
| + explicit OnLoadFrameRemover(RenderView* render_view) :
|
| + RenderViewObserver(render_view) {}
|
| + virtual ~OnLoadFrameRemover() {}
|
| +
|
| + virtual void DidFinishDocumentLoad(blink::WebFrame* frame) OVERRIDE {
|
| + if (frame->top() != frame) {
|
| + frame->top()->executeScript(blink::WebScriptSource(
|
| + WebString::fromUTF8(
|
| + "document.getElementById('frame').remove();")));
|
| + }
|
| + }
|
| + };
|
| +};
|
| +
|
| +// Tests if synchronously removing a frame on its load does not cause crashes.
|
| +TEST_F(SynchronousFrameRemovalOnLoadTest, DynamicallyInsertedFrame) {
|
| + OnLoadFrameRemover remover(view());
|
| + LoadHTML("<!DOCTYPE html>"
|
| + "<html>"
|
| + "<head>"
|
| + "<title></title>"
|
| + "<script type='text/javascript' language='javascript'>"
|
| + "window.onload = function () {"
|
| + " frame = document.createElement('iframe');"
|
| + " frame.id = 'frame';"
|
| + " document.body.appendChild(frame);"
|
| + "}"
|
| + "</script>"
|
| + "</head>"
|
| + "<body></body>"
|
| + "</html>");
|
| +}
|
| +
|
| +TEST_F(SynchronousFrameRemovalOnLoadTest, StaticFrame) {
|
| + OnLoadFrameRemover remover(view());
|
| + LoadHTML("<!DOCTYPE html>"
|
| + "<html>"
|
| + "<head>"
|
| + "<title></title>"
|
| + "</head>"
|
| + "<body>"
|
| + "<iframe id='frame' src='about:blank'></iframe>"
|
| + "</body>"
|
| + "</html>");
|
| +}
|
| +
|
| } // namespace content
|
|
|
Chromium Code Reviews
Issue 112203003:
Fix renderer crashes when frame gets detached while injectng user scripts. (Closed)
Base URL: https://chromium.googlesource.com/chromium/src.git@master