MHTML generation: safely serialize image documents

third_party/WebKit/Source/web/tests/WebFrameSerializerTest.cpp

Index: third_party/WebKit/Source/web/tests/WebFrameSerializerTest.cpp
diff --git a/third_party/WebKit/Source/web/tests/WebFrameSerializerTest.cpp b/third_party/WebKit/Source/web/tests/WebFrameSerializerTest.cpp
index d196b2b19a0490179b782435e78aa8a9271ddcc6..3379845abfbe1e8253d3093dd35f01a253c1187d 100644
--- a/third_party/WebKit/Source/web/tests/WebFrameSerializerTest.cpp
+++ b/third_party/WebKit/Source/web/tests/WebFrameSerializerTest.cpp
@@ -198,10 +198,12 @@ class WebFrameSerializerSanitizationTest : public WebFrameSerializerTest {
 
   ~WebFrameSerializerSanitizationTest() override {}
 
-  String generateMHTMLParts(const String& url, const String& fileName) {
+  String generateMHTMLParts(const String& url,
+                            const String& fileName,
+                            const String& mimeType = "text/html") {
     KURL parsedURL(ParsedURLString, url);
     URLTestHelpers::registerMockedURLLoad(parsedURL, fileName,
-                                          "frameserialization/", "text/html");
+                                          "frameserialization/", mimeType);
     FrameTestHelpers::loadFrame(mainFrameImpl(), url.utf8().data());
     WebThreadSafeData result = WebFrameSerializer::generateMHTMLParts(
         WebString("boundary"), mainFrameImpl(), &m_mhtmlDelegate);
@@ -274,4 +276,12 @@ TEST_F(WebFrameSerializerSanitizationTest, RemoveHiddenElements) {
   EXPECT_NE(WTF::kNotFound, mhtml.find("<div"));
 }
 
+// Regression test for crbug.com/678893, where in some cases serializing an
+// image document could cause code to pick an element from an empty container.
+TEST_F(WebFrameSerializerSanitizationTest, FromBrokenImageDocument) {
+  String mhtml = generateMHTMLParts("http://www.test.com", "broken-image.png",
+                                    "image/png");
+  EXPECT_TRUE(mhtml.isEmpty());
+}
+
 }  // namespace blink