Fix stale focusedElement in unloaded document.

Fix stale focusedElement in unloaded document.

When appendChild()/adoptNode() moves a node between different documents,
any focused node under moving node will be cleared, but it is done before
"unload" event is dispatched.

So if combined with <iframe>, focusing that frame in "unload" event can
trigger stale focused element reference from the old document tree.

This CL tries to fix that by checking if the element is the owner of
the frame that is being unloaded.

BUG=677690
Review-Url: https://codereview.chromium.org/2692423006
Cr-Commit-Position: refs/heads/master@{#451271}
Committed: https://chromium.googlesource.com/chromium/src/+/b16ecc7508fb9da7626dad7708d04b1f745c54e1

[kochi, 2017-02-17 06:10:44]

The CQ bit was checked by kochi@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-02-17 06:11:30]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[kochi, 2017-02-17 06:42:30]

Description was changed from

==========
Fix stale focusedElement in unloaded document.

When appendChild()/adoptNode() moves a node between different documents,
any focused node under moving node will be cleared, but it is done before
"unload" event is dispatched.

So if combined with <iframe>, focusing that frame in "unload" event can
trigger stale focused element reference from the old document tree.

This CL tries to fix that by checking if the element is the owner of
the frame that is being unloaded.

BUG=677690
==========

to

==========
Fix stale focusedElement in unloaded document.

When appendChild()/adoptNode() moves a node between different documents,
any focused node under moving node will be cleared, but it is done before
"unload" event is dispatched.

So if combined with <iframe>, focusing that frame in "unload" event can
trigger stale focused element reference from the old document tree.

This CL tries to fix that by checking if the element is the owner of
the frame that is being unloaded.

BUG=677690
==========

[kochi, 2017-02-17 06:42:30]

kochi@chromium.org changed reviewers:
+ tkent@chromium.org

[kochi, 2017-02-17 06:42:49]

tkent-san, could you review?

[tkent, 2017-02-17 06:48:37]

lgtm

[kochi, 2017-02-17 07:20:34]

The CQ bit was unchecked by kochi@chromium.org

[kochi, 2017-02-17 07:20:35]

The CQ bit was checked by kochi@chromium.org

[commit-bot: I haz the power, 2017-02-17 07:20:53]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-02-17 07:30:26]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-02-17 07:30:27]

Try jobs failed on following builders:
  linux_chromium_chromeos_rel_ng on master.tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)

[tkent, 2017-02-17 07:34:01]

https://codereview.chromium.org/2692423006/diff/1/third_party/WebKit/Source/c...
File third_party/WebKit/Source/core/dom/Element.cpp (right):

https://codereview.chromium.org/2692423006/diff/1/third_party/WebKit/Source/c...
third_party/WebKit/Source/core/dom/Element.cpp:2648:
toHTMLFrameOwnerElement(this)->contentDocument()->unloadStarted())
contnetDocument() might return nullptr.

[kochi, 2017-02-17 07:44:15]

The CQ bit was checked by kochi@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-02-17 07:44:38]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[kochi, 2017-02-17 08:08:58]

On 2017/02/17 07:34:01, tkent wrote:
>
https://codereview.chromium.org/2692423006/diff/1/third_party/WebKit/Source/c...
> File third_party/WebKit/Source/core/dom/Element.cpp (right):
> 
>
https://codereview.chromium.org/2692423006/diff/1/third_party/WebKit/Source/c...
> third_party/WebKit/Source/core/dom/Element.cpp:2648:
> toHTMLFrameOwnerElement(this)->contentDocument()->unloadStarted())
> contnetDocument() might return nullptr.

Thanks, updated the patchset 2.

[tkent, 2017-02-17 08:51:14]

lgtm

[kochi, 2017-02-17 08:51:45]

The CQ bit was unchecked by kochi@chromium.org

[kochi, 2017-02-17 08:51:45]

The CQ bit was checked by kochi@chromium.org

[commit-bot: I haz the power, 2017-02-17 08:51:57]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-02-17 09:10:44]

CQ is committing da patch.

Bot data: {"patchset_id": 20001, "attempt_start_ts": 1487321505466880,
"parent_rev": "e8a65d35c402aa21c4ce9b07a63a109d113a6066", "commit_rev":
"b16ecc7508fb9da7626dad7708d04b1f745c54e1"}

[commit-bot: I haz the power, 2017-02-17 09:11:22]

Description was changed from

==========
Fix stale focusedElement in unloaded document.

When appendChild()/adoptNode() moves a node between different documents,
any focused node under moving node will be cleared, but it is done before
"unload" event is dispatched.

So if combined with <iframe>, focusing that frame in "unload" event can
trigger stale focused element reference from the old document tree.

This CL tries to fix that by checking if the element is the owner of
the frame that is being unloaded.

BUG=677690
==========

to

==========
Fix stale focusedElement in unloaded document.

When appendChild()/adoptNode() moves a node between different documents,
any focused node under moving node will be cleared, but it is done before
"unload" event is dispatched.

So if combined with <iframe>, focusing that frame in "unload" event can
trigger stale focused element reference from the old document tree.

This CL tries to fix that by checking if the element is the owner of
the frame that is being unloaded.

BUG=677690

Review-Url: https://codereview.chromium.org/2692423006
Cr-Commit-Position: refs/heads/master@{#451271}
Committed:
https://chromium.googlesource.com/chromium/src/+/b16ecc7508fb9da7626dad7708d0...
==========

[commit-bot: I haz the power, 2017-02-17 09:11:24]

Committed patchset #2 (id:20001) as
https://chromium.googlesource.com/chromium/src/+/b16ecc7508fb9da7626dad7708d0...