Chromium Code Reviews Chromium Code Reviews
Issue 1315983004:
Fix use-after-free bug in long press selection (Closed)
Base URL: https://chromium.googlesource.com/chromium/blink.git@master| Index: LayoutTests/editing/selection/longpress-selection-in-iframe-removed-crash.html |
| diff --git a/LayoutTests/editing/selection/longpress-selection-in-iframe-removed-crash.html b/LayoutTests/editing/selection/longpress-selection-in-iframe-removed-crash.html |
| new file mode 100644 |
| index 0000000000000000000000000000000000000000..c28d3b0e72140d84b0f33257c18560e4749c49fe |
| --- /dev/null |
| +++ b/LayoutTests/editing/selection/longpress-selection-in-iframe-removed-crash.html |
| @@ -0,0 +1,35 @@ |
| +<!DOCTYPE html> |
| + |
|
yosin_UTC9
2015/09/01 01:33:29
nit: We don't need to have an extra blank line.
majidvp
2015/09/01 15:33:53
Done.
|
| +<script src="../../resources/testharness.js"></script> |
| +<script src="../../resources/testharnessreport.js"></script> |
| +<script type="text/javascript"> |
| + "use strict"; |
|
yosin_UTC9
2015/09/01 01:33:29
nit: We don't need to have "use strict", because t
majidvp
2015/09/01 15:33:53
That is correct. Given it is irrelevant I prefer t
|
| + |
| + async_test(function(t) { |
| + document.addEventListener("DOMContentLoaded", t.step_func(function() { |
| + var iframe1 = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe"); |
| + iframe1.setAttribute("srcdoc", "ABC"); |
| + document.documentElement.appendChild(iframe1); |
| + var document1 = document.implementation.createDocument("", null); |
| + iframe1.addEventListener("DOMFocusOut", function() { |
| + document1.adoptNode(iframe1); |
| + }); |
| + iframe1.focus(); |
| + |
| + iframe1.addEventListener("load", t.step_func(function() { |
| + document.designMode = "on"; |
| + |
| + var clientRect = iframe1.getBoundingClientRect(); |
| + var x = clientRect.left + 10; |
| + var y = clientRect.top + 10; |
| + if (window.eventSender) |
|
yosin_UTC9
2015/09/01 01:33:29
nit: It is better to check |window.eventSender| at
majidvp
2015/09/01 15:33:53
Done.
|
| + eventSender.gestureLongPress(x, y); |
| + else |
| + assert_unreached("This test requires window.eventSender to exist"); |
| + |
| + // Test passes if it does not crash and reaches this point |
| + setTimeout(t.done.bind(t), 0); |
| + })); |
| + })); |
| + }, "Test longpress selection does not crash"); |
| +</script> |
