third_party/WebKit/LayoutTests/fast/dom/Window/orphaned-frame-access.html - Issue 2706923002: Rework security checks to be based on Window rather than Frame.

Unified Diff: third_party/WebKit/LayoutTests/fast/dom/Window/orphaned-frame-access.html

Issue 2706923002: Rework security checks to be based on Window rather than Frame. (Closed)

Patch Set: Do not hardcode V8Window::wrapperTypeInfo Created 3 years, 7 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View side-by-side diff with in-line comments

Index: third_party/WebKit/LayoutTests/fast/dom/Window/orphaned-frame-access.html

diff --git a/third_party/WebKit/LayoutTests/fast/dom/Window/orphaned-frame-access.html b/third_party/WebKit/LayoutTests/fast/dom/Window/orphaned-frame-access.html

index 1a0ec1bdbf6cde672c173c5520e835b0fbcfc853..a97c4dd80570dd5a0e1ebb134857ee3fdd5700d4 100644

--- a/third_party/WebKit/LayoutTests/fast/dom/Window/orphaned-frame-access.html

+++ b/third_party/WebKit/LayoutTests/fast/dom/Window/orphaned-frame-access.html

@@ -2,33 +2,35 @@

<html>

<head>

<title>Null frame access tests</title>

-<script src="../../../resources/js-test.js"></script>

-<script>

-description("This tests access to a window with a null frame. You should see \"PASS\" for each of the three tests below.");

-window.jsTestIsAsync = true;

-window.onload = function() {

- if (window.testRunner) {

- testRunner.dumpAsText();

- testRunner.waitUntilDone();

- }

- var tag = document.getElementById('subframe');

- var win = tag.contentWindow;

- // remove the element so the window has a null frame

- tag.parentNode.removeChild(tag);

- // schedule to run after the frame is null

- asyncGC(function() {

- debug("missing property: " + (win.test || 'PASS'))

- debug("missing array index: " + (win[20] || 'PASS'));

- debug("missing interface object: " + (win.Comment || 'PASS'));

- finishJSTest();

- });

-};

-</script>

+<script src="../../../resources/testharness.js"></script>

+<script src="../../../resources/testharnessreport.js"></script>

</head>

<body>

-<iframe id="subframe" src="data:text/html,<script>window.test='FAIL ... ';window[20]='FAIL ... ';</script>" />

+<iframe></iframe/>

+<script>

+window[0].test = 'abc';

+window[0][20] = 123;

+var childWindow = window[0];

+window[0].frameElement.remove();

+test(function() {

+ // Removing the owner element from the DOM should null the frame. In Blink,

+ // this can be observed by checking childWindow.parent == null.

+ assert_equals(childWindow.parent, null);

+ assert_equals(childWindow.test, 'abc');

+}, 'Named property access on detached Window');

+test(function() {

+ // Removing the owner element from the DOM should null the frame. In Blink,

+ // this can be observed by checking childWindow.parent == null.

+ assert_equals(childWindow.parent, null);

+ assert_equals(childWindow[20], '123', 'Indexed property should still be accessible.');

+}, 'Indexed property access on detached Window');

+test(function() {

+ // Removing the owner element from the DOM should null the frame. In Blink,

+ // this can be observed by checking childWindow.parent == null.

+ assert_equals(childWindow.parent, null);

+ // TODO(dcheng): Why does this return null?

+ assert_equals(childWindow.Comment, undefined, 'Interface Object should be gone.');

+}, 'Interface Object access on detached Window');

+</script>

</body>

</html>

« no previous file with comments | « no previous file | third_party/WebKit/LayoutTests/fast/dom/Window/orphaned-frame-access-expected.txt » ('j') | no next file with comments »