diff options
| author | ananta@chromium.org <ananta@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2008-10-28 21:54:08 +0000 |
|---|---|---|
| committer | ananta@chromium.org <ananta@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2008-10-28 21:54:08 +0000 |
| commit | 241639dd034255478926cf4e7dea7447717220cc (patch) | |
| tree | f195e9e508fb13861020865fff013b4d93c3dd52 /chrome/test/data | |
| parent | 8907d0469ed010147265c95017102d1d976565f3 (diff) | |
| download | chromium_src-241639dd034255478926cf4e7dea7447717220cc.zip chromium_src-241639dd034255478926cf4e7dea7447717220cc.tar.gz chromium_src-241639dd034255478926cf4e7dea7447717220cc.tar.bz2 | |
Proposed fix for http://b/issue?id=1362948, which is a crash in the rendererwhen we invoke the setCursor call on the parent view in WebPluginImpl::handleEvent.
This crash occurs because the plugin is deleted in the context of a mouse down event. This could occur by invoking a javascript function via NPN_Evaluate. On return from the HandleEvent sync call we attempt to retreive the parent frame, which
returns NULL and hence the crash.
The fix is to retreive the parent frameview at the start of the WebPluginImpl::handleMouseEvent function and use it whereever needed.
Added a unit test which deletes the plugin instance in a mousemove event.R=jamBug=1362948
Review URL: http://codereview.chromium.org/8178
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@4094 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'chrome/test/data')
| -rw-r--r-- | chrome/test/data/npapi/execute_script_delete_in_mouse_move.html | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/chrome/test/data/npapi/execute_script_delete_in_mouse_move.html b/chrome/test/data/npapi/execute_script_delete_in_mouse_move.html new file mode 100644 index 0000000..a82cde7 --- /dev/null +++ b/chrome/test/data/npapi/execute_script_delete_in_mouse_move.html @@ -0,0 +1,39 @@ +<html> + +<head> +<script src="npapi.js"></script> + +<script> +function DeletePluginWithinScript() { + var plugin_div = document.getElementById("PluginDiv"); + plugin_div.innerHTML = "Object Deleted"; + onSuccess("execute_script_delete_in_mouse_move", 1); +} +</script> +</head> + +<body> +<div id="statusPanel" style="border: 1px solid red; width: 100%"> +Test running.... +</div> + + +NPObject Proxy Test<p> + +Tests the case where a plugin instance is deleted in the context +of a synchronous mouse event. + +<DIV ID=PluginDiv> +<embed type="application/vnd.npapi-test" + src="foo" + name="execute_script_delete_in_mouse_move" + id="1" + mode="np_embed" +> +</DIV> +<script> + var height = document.body.offsetHeight; +</script> + +</body> +</html> |