summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--chrome/browser/views/find_bar_win_browsertest.cc16
-rw-r--r--chrome/test/data/find_in_page/crash_14491.html8
2 files changed, 24 insertions, 0 deletions
diff --git a/chrome/browser/views/find_bar_win_browsertest.cc b/chrome/browser/views/find_bar_win_browsertest.cc
index 67b05ad..b79e18e 100644
--- a/chrome/browser/views/find_bar_win_browsertest.cc
+++ b/chrome/browser/views/find_bar_win_browsertest.cc
@@ -25,6 +25,7 @@ const std::wstring kTooFewMatchesPage = L"files/find_in_page/bug_1155639.html";
const std::wstring kEndState = L"files/find_in_page/end_state.html";
const std::wstring kPrematureEnd = L"files/find_in_page/premature_end.html";
const std::wstring kMoveIfOver = L"files/find_in_page/move_if_obscuring.html";
+const std::wstring kBitstackCrash = L"files/find_in_page/crash_14491.html";
class FindInPageNotificationObserver : public NotificationObserver {
public:
@@ -359,6 +360,21 @@ IN_PROC_BROWSER_TEST_F(FindInPageControllerTest, FindCrash_Issue1341577) {
EXPECT_EQ(0, ordinal);
}
+// Try to reproduce the crash seen in http://crbug.com/14491, where an assert
+// hits in the BitStack size comparison in WebKit.
+IN_PROC_BROWSER_TEST_F(FindInPageControllerTest, FindCrash_Issue14491) {
+ HTTPTestServer* server = StartHTTPServer();
+
+ // First we navigate to our page.
+ GURL url = server->TestServerPageW(kBitstackCrash);
+ ui_test_utils::NavigateToURL(browser(), url);
+
+ // This used to crash the tab.
+ int ordinal = 0;
+ EXPECT_EQ(0, FindInPage(L"s", FWD, IGNORE_CASE, &ordinal));
+ EXPECT_EQ(0, ordinal);
+}
+
// Test to make sure Find does the right thing when restarting from a timeout.
// We used to have a problem where we'd stop finding matches when all of the
// following conditions were true:
diff --git a/chrome/test/data/find_in_page/crash_14491.html b/chrome/test/data/find_in_page/crash_14491.html
new file mode 100644
index 0000000..2b9c9d8
--- /dev/null
+++ b/chrome/test/data/find_in_page/crash_14491.html
@@ -0,0 +1,8 @@
+<html>
+<body>
+ <form><input type="text" id="search" /></form>
+ <script type="text/javascript">
+ document.getElementById("search").setAttribute("type","search");
+ </script>
+</body>
+</html> \ No newline at end of file