Index: third_party/WebKit/LayoutTests/fast/dom/Selection/selection-crash.html |
diff --git a/third_party/WebKit/LayoutTests/fast/dom/Selection/selection-crash.html b/third_party/WebKit/LayoutTests/fast/dom/Selection/selection-crash.html |
new file mode 100644 |
index 0000000000000000000000000000000000000000..e222eb5fb73be5ab5f642eb8a2cd05900c57182e |
--- /dev/null |
+++ b/third_party/WebKit/LayoutTests/fast/dom/Selection/selection-crash.html |
@@ -0,0 +1,34 @@ |
+<!DOCTYPE HTML> |
+<script src="../../../resources/testharness.js"></script> |
+<script src="../../../resources/testharnessreport.js"></script> |
+<button id="button"></button> |
+<iframe id="iframe"></iframe> |
+<script> |
+// This is a crash reproduction case for crbug.com/626750. |
+ |
+// Things are expected to happen in this order: |
+// 1. window.onload event fires |
+// 2. button.focus() |
+// 3. button's focus event handler is called |
+// 4. iframe.contentWindow.focus() |
+// 5. button's blur event handler is called (due to 4) |
+// 6. document.open() (detaches <iframe>) |
+// 7. focus in iframe blurs |
+// 8. iframe is set to active while detached <- crash due to crbug.com/626750 |
+// 9. script execution gets back to button's focus event handler |
+// (4-8 happen while iframe.contentWindow.focus() is handled) |
+ |
+async_test((test) => { |
+ button.addEventListener('focus', test.step_func_done(() => { |
+ iframe.contentWindow.focus(); |
+ assert_equals(document.activeElement, null, 'blur handler properly finished.'); |
+ })); |
+ |
+ button.addEventListener('blur', test.step_func(() => { |
+ // This detaches <iframe>. |
+ document.open(); |
+ })); |
+ |
+ window.addEventListener('load', () => button.focus()); |
+}, 'focusing on detached frame should not crash'); |
+</script> |