Index: LayoutTests/http/tests/serviceworker/chromium/document-close-during-controllerchange.html |
diff --git a/LayoutTests/http/tests/serviceworker/chromium/document-close-during-controllerchange.html b/LayoutTests/http/tests/serviceworker/chromium/document-close-during-controllerchange.html |
new file mode 100644 |
index 0000000000000000000000000000000000000000..b8329464dd18f60590ce8db00c092dbf10a58ef8 |
--- /dev/null |
+++ b/LayoutTests/http/tests/serviceworker/chromium/document-close-during-controllerchange.html |
@@ -0,0 +1,38 @@ |
+<!DOCTYPE html> |
+<title>Service Worker: document close during controllerchange</title> |
+<script src="../../resources/testharness.js"></script> |
+<script src="../../resources/testharnessreport.js"></script> |
+<script src="../resources/test-helpers.js"></script> |
+<script> |
+ |
+async_test(function(t) { |
+ var scope = '../resources/blank.html'; |
+ var url1 = '../resources/empty.js'; |
+ var url2 = '../resources/skip-waiting-worker.js'; |
+ |
+ service_worker_unregister_and_register(t, url1, scope) |
+ .then(function(registration) { |
+ return wait_for_update(t, registration); |
falken
2014/12/04 06:15:38
this can just be:
return wait_for_state(t, registr
|
+ }) |
+ .then(function(sw) { |
+ return wait_for_state(t, sw, 'activated'); |
+ }) |
+ .then(function() { |
+ return with_iframe(scope); |
+ }) |
+ .then(function(frame) { |
+ var frame_sw = frame.contentWindow.navigator.serviceWorker; |
falken
2014/12/04 06:15:38
I'm wondering if this test actually exercises what
xiang
2014/12/04 08:17:26
I think use-after-free could happen in both JS & C
falken
2014/12/04 08:59:12
My doubt with that is it doesn't test what happens
xiang
2014/12/11 11:24:32
You're right, the gc() won't real happen before re
|
+ frame_sw.oncontrollerchange = t.step_func(function() { |
+ unload_iframe(frame) |
+ .then(function() { |
+ assert_equals(frame_sw.controller.state, 'activating', |
+ 'Controller should still be accessible'); |
+ service_worker_unregister_and_done(t); |
+ }); |
+ }); |
+ navigator.serviceWorker.register(url2, {scope: scope}); |
+ }) |
+ .catch(unreached_rejection(t)); |
+ }, 'Access ServiceWorkerContainer after its document removed.'); |
+ |
+</script> |