LayoutTests/editing/selection/longpress-selection-in-iframe-removed-crash.html - Issue 1315983004: Fix use-after-free bug in long press selection

Side by Side Diff: LayoutTests/editing/selection/longpress-selection-in-iframe-removed-crash.html

Issue 1315983004: Fix use-after-free bug in long press selection (Closed) Base URL: https://chromium.googlesource.com/chromium/blink.git@master

Patch Set: fix minor issue Created 5 years, 3 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch

« no previous file with comments | « no previous file | LayoutTests/editing/selection/longpress-selection-in-iframe-removed-crash-expected.txt » ('j') | LayoutTests/editing/selection/longpress-selection-in-iframe-removed-crash-expected.txt » ('J')
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Hide Comments ('s')

OLD	NEW
1 <!DOCTYPE html>	1 <!DOCTYPE html>

2 <html>	2 <html>

3 Test passes if it does not crash.	3 Test passes if it does not crash.

4 <script>	4 <script>

5 if (window.testRunner)	5 if (!window.testRunner \|\| !window.eventSender)

	6 document.body.textContent = "The test requires window.testRunner and window. eventSender";

	7

	8 if (window.testRunner) {

	9 testRunner.waitUntilDone();

6 testRunner.dumpAsText();	10 testRunner.dumpAsText();

	11 }

7	12

8 var docElement = document.documentElement;	13 var docElement = document.documentElement;

9 function crash() {	14 function crash() {

10 iframe1 = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe") ;	15 iframe1 = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe") ;

11 iframe1.setAttribute("srcdoc", "ABC");	16 iframe1.setAttribute("srcdoc", "ABC");

12 docElement.appendChild(iframe1);	17 docElement.appendChild(iframe1);

13 document1 = document.implementation.createDocument("", null);	18 document1 = document.implementation.createDocument("", null);

14 iframe1.addEventListener("DOMFocusOut", function () { document1.adoptNode(if rame1); }, false);	19 iframe1.addEventListener("DOMFocusOut", function () { document1.adoptNode(if rame1); }, false);

15 iframe1.focus();	20 iframe1.focus();

16 setTimeout("finish();", 0);	21 iframe1.addEventListener('load', finish, false);
	yosin_UTC9 2015/08/31 02:11:13 nit: We don't need to have \|false\|. nit: We don't need to have \|false\|. majidvp 2015/08/31 18:06:25 Done. Show quoted text On 2015/08/31 02:11:13, Yosi_UTC9 wrote: > nit: We don't need to have \|false\|. Done. majidvp 2015/08/31 18:06:25 Acknowledged. Show quoted text On 2015/08/31 02:11:13, Yosi_UTC9 wrote: > nit: We don't need to have \|false\|. Acknowledged.
17 }	22 }

18	23

19 function finish() {	24 function finish() {

20 document.designMode = "on";	25 document.designMode = "on";

21 range1 = document.createRange();	26

22 range1.selectNodeContents(iframe1.contentDocument);	27 var clientRect = iframe1.getBoundingClientRect();

23 window.getSelection().addRange(range1);	28 var x = clientRect.left + 10;

	29 var y = clientRect.top + 10;

	30 if (window.eventSender)

	31 eventSender.gestureLongPress(x, y);

	32

	33 if (window.testRunner)

	34 setTimeout(function(){ testRunner.notifyDone(); }, 0);
	yosin_UTC9 2015/08/31 02:11:13 nit: insert an space after \|()\|. nit: insert an space after \|()\|. majidvp 2015/08/31 18:06:25 Done. Show quoted text On 2015/08/31 02:11:13, Yosi_UTC9 wrote: > nit: insert an space after \|()\|. Done.
24 }	35 }

25	36

26 document.addEventListener("DOMContentLoaded", crash, false);	37 document.addEventListener("DOMContentLoaded", crash, false);
	yosin_UTC9 2015/08/31 02:11:13 nit: We don't need to have \|false\|. nit: We don't need to have \|false\|. majidvp 2015/08/31 18:06:25 Done. Show quoted text On 2015/08/31 02:11:13, Yosi_UTC9 wrote: > nit: We don't need to have \|false\|. Done.
27 </script>	38 </script>

28 </html>	39 </html>

OLD	NEW