Chromium Code Reviews Chromium Code Reviews
Issue 2586633002:
Dispose a persisted plugin widget if the content frame is detached. (Closed)
| Index: third_party/WebKit/LayoutTests/fast/plugins/update-plugin-after-detachment-crash.html |
| diff --git a/third_party/WebKit/LayoutTests/fast/plugins/update-plugin-after-detachment-crash.html b/third_party/WebKit/LayoutTests/fast/plugins/update-plugin-after-detachment-crash.html |
| new file mode 100644 |
| index 0000000000000000000000000000000000000000..9b02026e47e83208c25f1c33f3f73d7ee054a5fd |
| --- /dev/null |
| +++ b/third_party/WebKit/LayoutTests/fast/plugins/update-plugin-after-detachment-crash.html |
| @@ -0,0 +1,40 @@ |
| +<!DOCTYPE html> |
| +<script src = "../../resources/testharness.js"></script> |
| +<script src = "../../resources/testharnessreport.js"></script> |
| +<script> |
| +var t = async_test("Don't reuse disposed FrameView for <embed>"); |
| + |
| +onload = t.unreached_func("window load should not fire before embed load"); |
| + |
| +function embedLoaded() { |
| + var video = document.createElement("video"); |
| + video.poster = "foo"; |
|
dcheng
2016/12/17 09:09:43
I have no idea why this is necessary.
|
| + |
| + document.querySelector('iframe').srcdoc = "data:text/html,bar"; |
| + |
| + setTimeout(function() { |
| + var embed = document.querySelector('embed'); |
| + embed.align = "right"; |
| + embed.height = "28"; |
| + embed.type = "foo"; |
|
dcheng
2016/12/17 09:09:43
Similarly, all three of these lines are necessary.
|
| + |
| + onload = t.step_func(function () { |
| + var object = document.createElement("object"); |
| + // Trying to access a named property on <object> will run post layout tasks |
| + // synchronously from HTMLPluginElement::layoutPartForJSBindings(). Make sure |
| + // it doesn't try to re-load a persisted FrameView for a detached frame. |
| + object.whatever = "anything"; |
| + |
| + // Getting here without crashing implies the test passed. |
| + t.done(); |
| + }); |
| + |
| + // This will cause detach the embed and iframe element, which will cause the |
| + // window load event to fire, since all loading subframes will have been |
| + // detached. |
| + document.body.innerText = ""; |
| + }, 0); |
| +}; |
| +</script> |
| +<embed onload="embedLoaded()" src="foo"></embed> |
| +<iframe></iframe> |
