Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(1034)

Unified Diff: third_party/WebKit/LayoutTests/fast/dom/Selection/selection-crash.html

Issue 2153063003: Should not call FocusController::setFocusedFrame() for detached frame (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: fix for comment #26 Created 4 years, 5 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | third_party/WebKit/Source/core/page/FocusController.cpp » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: third_party/WebKit/LayoutTests/fast/dom/Selection/selection-crash.html
diff --git a/third_party/WebKit/LayoutTests/fast/dom/Selection/selection-crash.html b/third_party/WebKit/LayoutTests/fast/dom/Selection/selection-crash.html
new file mode 100644
index 0000000000000000000000000000000000000000..e222eb5fb73be5ab5f642eb8a2cd05900c57182e
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/dom/Selection/selection-crash.html
@@ -0,0 +1,34 @@
+<!DOCTYPE HTML>
+<script src="../../../resources/testharness.js"></script>
+<script src="../../../resources/testharnessreport.js"></script>
+<button id="button"></button>
+<iframe id="iframe"></iframe>
+<script>
+// This is a crash reproduction case for crbug.com/626750.
+
+// Things are expected to happen in this order:
+// 1. window.onload event fires
+// 2. button.focus()
+// 3. button's focus event handler is called
+// 4. iframe.contentWindow.focus()
+// 5. button's blur event handler is called (due to 4)
+// 6. document.open() (detaches <iframe>)
+// 7. focus in iframe blurs
+// 8. iframe is set to active while detached <- crash due to crbug.com/626750
+// 9. script execution gets back to button's focus event handler
+// (4-8 happen while iframe.contentWindow.focus() is handled)
+
+async_test((test) => {
+ button.addEventListener('focus', test.step_func_done(() => {
+ iframe.contentWindow.focus();
+ assert_equals(document.activeElement, null, 'blur handler properly finished.');
+ }));
+
+ button.addEventListener('blur', test.step_func(() => {
+ // This detaches <iframe>.
+ document.open();
+ }));
+
+ window.addEventListener('load', () => button.focus());
+}, 'focusing on detached frame should not crash');
+</script>
« no previous file with comments | « no previous file | third_party/WebKit/Source/core/page/FocusController.cpp » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698