diff options
| author | jianli@chromium.org <jianli@chromium.org@bbb929c8-8fbe-4397-9dbb-9b2b20218538> | 2009-05-29 21:58:50 +0000 |
|---|---|---|
| committer | jianli@chromium.org <jianli@chromium.org@bbb929c8-8fbe-4397-9dbb-9b2b20218538> | 2009-05-29 21:58:50 +0000 |
| commit | 9d67db164e80e4f555b97c2c0b36aab2762ea3a3 (patch) | |
| tree | 68a2357e9f64e9d51e6d1ec2e48d4e92a2a678b0 /third_party/WebKit/LayoutTests/fast/xmlhttprequest/xmlhttprequest-open-after-iframe-onload-remove-self.html | |
| parent | ca5b26a045c8cd6c8b5bdc03284c9238ea755046 (diff) | |
| download | chromium_src-9d67db164e80e4f555b97c2c0b36aab2762ea3a3.zip chromium_src-9d67db164e80e4f555b97c2c0b36aab2762ea3a3.tar.gz chromium_src-9d67db164e80e4f555b97c2c0b36aab2762ea3a3.tar.bz2 | |
WebCore:
2009-05-29 Jian Li <jianli@chromium.org>
Reviewed by Dimitri Glazkov.
https://bugs.webkit.org/show_bug.cgi?id=26069
Fix a crash in custom V8 bindings code for XMLHttpRequest.
Test: fast/xmlhttprequest/xmlhttprequest-open-after-iframe-onload-remove-self.html
* bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
(WebCore::CALLBACK_FUNC_DECL):
LayoutTests:
2009-05-29 Jian Li <jianli@chromium.org>
Reviewed by Dimitri Glazkov.
https://bugs.webkit.org/show_bug.cgi?id=26069
Test for the above bug.
* fast/xmlhttprequest/resources/xmlhttprequest-open-after-iframe-onload-remove-self-child.html: Added.
* fast/xmlhttprequest/xmlhttprequest-open-after-iframe-onload-remove-self-expected.txt: Added.
* fast/xmlhttprequest/xmlhttprequest-open-after-iframe-onload-remove-self.html: Added.
git-svn-id: svn://svn.chromium.org/blink/trunk@44275 bbb929c8-8fbe-4397-9dbb-9b2b20218538
Diffstat (limited to 'third_party/WebKit/LayoutTests/fast/xmlhttprequest/xmlhttprequest-open-after-iframe-onload-remove-self.html')
| -rw-r--r-- | third_party/WebKit/LayoutTests/fast/xmlhttprequest/xmlhttprequest-open-after-iframe-onload-remove-self.html | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/third_party/WebKit/LayoutTests/fast/xmlhttprequest/xmlhttprequest-open-after-iframe-onload-remove-self.html b/third_party/WebKit/LayoutTests/fast/xmlhttprequest/xmlhttprequest-open-after-iframe-onload-remove-self.html new file mode 100644 index 0000000..a1a51cc --- /dev/null +++ b/third_party/WebKit/LayoutTests/fast/xmlhttprequest/xmlhttprequest-open-after-iframe-onload-remove-self.html @@ -0,0 +1,21 @@ +<html> +<script> +if (window.layoutTestController) { + layoutTestController.dumpAsText(); + layoutTestController.waitUntilDone(); +} + +function onFrameLoad(frame) { + var client = frame.contentWindow.client(); + frame.parentNode.removeChild(frame); + client.open("GET", "DoesNotExist.txt"); + if (window.layoutTestController) + layoutTestController.notifyDone(); +} +</script> +<body> +This tests that removing a child frame in XMLHttpRequest does not crash the renderer. +<br> +<iframe src="resources/xmlhttprequest-open-after-iframe-onload-remove-self-child.html" onload="onFrameLoad(this)"></iframe> +</body> +</html> |