diff options
| author | mnaganov <mnaganov@chromium.org> | 2015-05-07 18:38:50 -0700 |
|---|---|---|
| committer | Commit bot <commit-bot@chromium.org> | 2015-05-08 01:40:08 +0000 |
| commit | 326214e563fba72a044205e784c8f4f7bfef2f85 (patch) | |
| tree | a45f0ba2bbae646abe24f0ca06690a3d72f1fb40 | |
| parent | d4b3c7e67549b47ec7ffd936c414a7f0bcf348de (diff) | |
| download | chromium_src-326214e563fba72a044205e784c8f4f7bfef2f85.zip chromium_src-326214e563fba72a044205e784c8f4f7bfef2f85.tar.gz chromium_src-326214e563fba72a044205e784c8f4f7bfef2f85.tar.bz2 | |
[Android] Add a regression test for the JB RemoveHolderAndAdvanceLocked issue
The test reproduces the condition which was triggering an infinite loop
inside GinJavaBridgeDispatcherHost::RenderFrameDeleted.
Verified that the test indeed hangs up and timeouts if the fix is removed.
BUG=484927
Review URL: https://codereview.chromium.org/1134543002
Cr-Commit-Position: refs/heads/master@{#328900}
| -rw-r--r-- | content/public/android/javatests/src/org/chromium/content/browser/JavaBridgeChildFrameTest.java | 55 |
1 files changed, 55 insertions, 0 deletions
diff --git a/content/public/android/javatests/src/org/chromium/content/browser/JavaBridgeChildFrameTest.java b/content/public/android/javatests/src/org/chromium/content/browser/JavaBridgeChildFrameTest.java index 2d494d0..1ed5ab4 100644 --- a/content/public/android/javatests/src/org/chromium/content/browser/JavaBridgeChildFrameTest.java +++ b/content/public/android/javatests/src/org/chromium/content/browser/JavaBridgeChildFrameTest.java @@ -13,6 +13,10 @@ import org.chromium.content_public.browser.LoadUrlParams; import org.chromium.content_public.browser.NavigationController; import org.chromium.content_public.browser.WebContents; +import java.util.concurrent.CountDownLatch; +import java.util.concurrent.TimeUnit; +import java.util.concurrent.TimeoutException; + /** * Part of the test suite for the WebView's Java Bridge. * @@ -105,6 +109,57 @@ public class JavaBridgeChildFrameTest extends JavaBridgeTestBase { "queryProperties(window.frames[0])")); } + // Regression test for crbug.com/484927 -- make sure that existence of transient + // objects held by multiple RenderFrames doesn't cause an infinite loop when one + // of them gets removed. + @SmallTest + @Feature({"AndroidWebView", "Android-JavaBridge"}) + public void testRemovingTransientObjectHolders() throws Throwable { + class Test { + private Object mInner = new Object(); + // Expecting the inner object to be retrieved twice. + private CountDownLatch mLatch = new CountDownLatch(2); + @JavascriptInterface + public Object getInner() { + mLatch.countDown(); + return mInner; + } + public void waitForInjection() throws Throwable { + if (!mLatch.await(5, TimeUnit.SECONDS)) { + throw new TimeoutException(); + } + } + } + final Test testObject = new Test(); + + injectObjectAndReload(testObject, "test"); + loadDataSync(getWebContents().getNavigationController(), + "<html>" + + "<body onload='window.inner_ref = test.getInner()'>" + + " <iframe id='frame' " + + " srcdoc='<body onload=\"window.inner_ref = test.getInner()\"></body>'>" + + " </iframe>" + + "</body></html>", "text/html", false); + testObject.waitForInjection(); + // Just in case, check that the object wrappers are in place. + assertEquals("\"object\"", + executeJavaScriptAndGetResult(getWebContents(), "typeof inner_ref")); + assertEquals("\"object\"", + executeJavaScriptAndGetResult(getWebContents(), + "typeof window.frames[0].inner_ref")); + // Remove the iframe, this will trigger a removal of RenderFrame, which was causing + // the bug condition, as the transient object still has a holder -- the main window. + assertEquals("{}", + executeJavaScriptAndGetResult(getWebContents(), + "(function(){ " + + "var f = document.getElementById('frame');" + + "f.parentNode.removeChild(f); return f; })()")); + // Just in case, check that the remaining wrapper is still accessible. + assertEquals("\"object\"", + executeJavaScriptAndGetResult(getWebContents(), + "typeof inner_ref")); + } + private String executeJavaScriptAndGetResult(final WebContents webContents, final String script) throws Throwable { final String[] result = new String[1]; |