Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(189)

Side by Side Diff: content/test/data/remove_frame_on_load.html

Issue 1756483004: Fix use-after-free when navigating a subframe to about:blank. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Created 4 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
(Empty)
1 <html>
2 <head>
3 <title>Remove frame on load of about:blank</title>
4 <script>
5 var f;
6 window.addEventListener('load', function() {
7 f = document.getElementById("f");
dcheng 2016/03/03 00:46:59 var f = document.querySelector('iframe'), then you
nasko 2016/03/03 16:59:17 Done.
8 f.onload = function() {
9 if (f.contentWindow.location.href == 'about:blank')
10 f.parentNode.removeChild(f);
11 };
12 });
13 </script>
14 </head>
15 <body>
16 <p>Navigate to about:blank page to cause frame to be removed.</p>
17 <iframe id="f" src="/cross-site/b.com/title2.html"></iframe>
18 </body>
19 </html>
OLDNEW
« content/renderer/render_frame_impl.cc ('K') | « content/renderer/render_frame_impl.cc ('k') | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698