| Index: LayoutTests/editing/selection/longpress-selection-in-iframe-removed-crash.html
|
| diff --git a/LayoutTests/editing/selection/longpress-selection-in-iframe-removed-crash.html b/LayoutTests/editing/selection/longpress-selection-in-iframe-removed-crash.html
|
| new file mode 100644
|
| index 0000000000000000000000000000000000000000..7e9d2d6f72aeac50d4f074537aef30b4a57538e5
|
| --- /dev/null
|
| +++ b/LayoutTests/editing/selection/longpress-selection-in-iframe-removed-crash.html
|
| @@ -0,0 +1,34 @@
|
| +<!DOCTYPE html>
|
| +<script src="../../resources/testharness.js"></script>
|
| +<script src="../../resources/testharnessreport.js"></script>
|
| +<script type="text/javascript">
|
| + "use strict";
|
| +
|
| + async_test(function(t) {
|
| + if (!window.eventSender)
|
| + assert_unreached("This test requires window.eventSender to exist");
|
| +
|
| + document.addEventListener("DOMContentLoaded", t.step_func(function() {
|
| + var iframe1 = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
|
| + iframe1.setAttribute("srcdoc", "ABC");
|
| + document.documentElement.appendChild(iframe1);
|
| + var document1 = document.implementation.createDocument("", null);
|
| + iframe1.addEventListener("DOMFocusOut", function() {
|
| + document1.adoptNode(iframe1);
|
| + });
|
| + iframe1.focus();
|
| +
|
| + iframe1.addEventListener("load", t.step_func(function() {
|
| + document.designMode = "on";
|
| +
|
| + var clientRect = iframe1.getBoundingClientRect();
|
| + var x = clientRect.left + 10;
|
| + var y = clientRect.top + 10;
|
| + eventSender.gestureLongPress(x, y);
|
| +
|
| + // Test passes if it does not crash and reaches this point
|
| + setTimeout(t.done.bind(t), 0);
|
| + }));
|
| + }));
|
| + }, "Test longpress selection does not crash");
|
| +</script>
|
|
|
Chromium Code Reviews
Issue 1315983004:
Fix use-after-free bug in long press selection (Closed)
Base URL: https://chromium.googlesource.com/chromium/blink.git@master