LayoutTests/media/remove-from-document-config-controls-no-crash.html - Issue 961243002: Do not reset controls upon removing media element from the DOM.

Side by Side Diff: LayoutTests/media/remove-from-document-config-controls-no-crash.html

Issue 961243002: Do not reset controls upon removing media element from the DOM. (Closed) Base URL: https://chromium.googlesource.com/chromium/blink.git@master

Patch Set: Created 5 years, 10 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch

OLD	NEW
(Empty)
	1 <!DOCTYPE html>

	2 <html>

	3 <head>

	4 <script src="../resources/js-test.js"></script>

	5 </head>

	6 <body>

	7 <video id="v"></video>

	8 <script>

	9 description("Verify that removing a video element from the DOM does not crash.") ;

	10

	11 window.jsTestIsAsync = true;

	12

	13 if (window.testRunner) {

	14 testRunner.dumpAsText();

	15 testRunner.waitUntilDone();

	16 }

	17

	18 function runTest() {

	19 if (!window.internals) {

	20 finishJSTest();

	21 return;

	22 }

	23 var video = document.getElementById('v');

	24 var videoShadow = window.internals.shadowRoot(video);

	25 traverse(videoShadow);

	26

	27 document.body.removeChild(video);

	28 finishJSTest();

	29 }

	30

	31 function traverse(node) {

	32 if (!node)

	33 return;

	34 if (node.attributes)

	35 Array.prototype.forEach.call(node.attributes, function (n) { node[n && n .localName] = 2; });
	philipj_slow 2015/02/27 10:35:29 This looks a bit cryptic to me. Is this to take co This looks a bit cryptic to me. Is this to take code paths for reflected attributes? sof 2015/02/27 10:39:54 It is a reduction from a fuzzer's doing; iterating Show quoted text On 2015/02/27 10:35:29, philipj_UTC7 wrote: > This looks a bit cryptic to me. Is this to take code paths for reflected > attributes? It is a reduction from a fuzzer's doing; iterating over .attributes is required to trigger the crashiness. philipj_slow 2015/02/27 11:04:33 Does it matter if node.foo is set or if the callba Show quoted text On 2015/02/27 10:39:54, sof wrote: > On 2015/02/27 10:35:29, philipj_UTC7 wrote: > > This looks a bit cryptic to me. Is this to take code paths for reflected > > attributes? > > It is a reduction from a fuzzer's doing; iterating over .attributes is required > to trigger the crashiness. Does it matter if node.foo is set or if the callback does nothing at all? sof 2015/02/27 11:16:34 It matters, involving node.max in particular..but Show quoted text On 2015/02/27 11:04:33, philipj_UTC7 wrote: > On 2015/02/27 10:39:54, sof wrote: > > On 2015/02/27 10:35:29, philipj_UTC7 wrote: > > > This looks a bit cryptic to me. Is this to take code paths for reflected > > > attributes? > > > > It is a reduction from a fuzzer's doing; iterating over .attributes is > required > > to trigger the crashiness. > > Does it matter if node.foo is set or if the callback does nothing at all? It matters, involving node.max in particular..but not entirely, I initially reduced the TC too far only to do that which left it triggering nested event dispatch asserts only. I'm not going to spend more time than the day already spent reducing this one.
	36 if (node.childNodes)

	37 Array.prototype.forEach.call(node.childNodes, traverse);

	38 if (node.localName == 'input')
	philipj_slow 2015/02/27 10:35:29 Could this not be made unconditional given the nul Could this not be made unconditional given the null check above? sof 2015/02/27 10:39:54 It could, but I don't see the value of making the Show quoted text On 2015/02/27 10:35:29, philipj_UTC7 wrote: > Could this not be made unconditional given the null check above? It could, but I don't see the value of making the test more generic. philipj_slow 2015/02/27 11:04:33 Very well, it looked to me like it was already try Show quoted text On 2015/02/27 10:39:54, sof wrote: > On 2015/02/27 10:35:29, philipj_UTC7 wrote: > > Could this not be made unconditional given the null check above? > > It could, but I don't see the value of making the test more generic. Very well, it looked to me like it was already trying to traverse as much as possible.
	39 traverse(window.internals.shadowRoot(node));

	40 }

	41 window.onload = runTest;

	42 </script>

	43 </html>

OLD	NEW

« no previous file with comments | « no previous file | LayoutTests/media/remove-from-document-config-controls-no-crash-expected.txt » ('j') | no next file with comments »