From 326214e563fba72a044205e784c8f4f7bfef2f85 Mon Sep 17 00:00:00 2001 From: mnaganov Date: Thu, 7 May 2015 18:38:50 -0700 Subject: [Android] Add a regression test for the JB RemoveHolderAndAdvanceLocked issue The test reproduces the condition which was triggering an infinite loop inside GinJavaBridgeDispatcherHost::RenderFrameDeleted. Verified that the test indeed hangs up and timeouts if the fix is removed. BUG=484927 Review URL: https://codereview.chromium.org/1134543002 Cr-Commit-Position: refs/heads/master@{#328900} --- .../content/browser/JavaBridgeChildFrameTest.java | 55 ++++++++++++++++++++++ 1 file changed, 55 insertions(+) diff --git a/content/public/android/javatests/src/org/chromium/content/browser/JavaBridgeChildFrameTest.java b/content/public/android/javatests/src/org/chromium/content/browser/JavaBridgeChildFrameTest.java index 2d494d0..1ed5ab4 100644 --- a/content/public/android/javatests/src/org/chromium/content/browser/JavaBridgeChildFrameTest.java +++ b/content/public/android/javatests/src/org/chromium/content/browser/JavaBridgeChildFrameTest.java @@ -13,6 +13,10 @@ import org.chromium.content_public.browser.LoadUrlParams; import org.chromium.content_public.browser.NavigationController; import org.chromium.content_public.browser.WebContents; +import java.util.concurrent.CountDownLatch; +import java.util.concurrent.TimeUnit; +import java.util.concurrent.TimeoutException; + /** * Part of the test suite for the WebView's Java Bridge. * @@ -105,6 +109,57 @@ public class JavaBridgeChildFrameTest extends JavaBridgeTestBase { "queryProperties(window.frames[0])")); } + // Regression test for crbug.com/484927 -- make sure that existence of transient + // objects held by multiple RenderFrames doesn't cause an infinite loop when one + // of them gets removed. + @SmallTest + @Feature({"AndroidWebView", "Android-JavaBridge"}) + public void testRemovingTransientObjectHolders() throws Throwable { + class Test { + private Object mInner = new Object(); + // Expecting the inner object to be retrieved twice. + private CountDownLatch mLatch = new CountDownLatch(2); + @JavascriptInterface + public Object getInner() { + mLatch.countDown(); + return mInner; + } + public void waitForInjection() throws Throwable { + if (!mLatch.await(5, TimeUnit.SECONDS)) { + throw new TimeoutException(); + } + } + } + final Test testObject = new Test(); + + injectObjectAndReload(testObject, "test"); + loadDataSync(getWebContents().getNavigationController(), + "" + + "" + + " " + + "", "text/html", false); + testObject.waitForInjection(); + // Just in case, check that the object wrappers are in place. + assertEquals("\"object\"", + executeJavaScriptAndGetResult(getWebContents(), "typeof inner_ref")); + assertEquals("\"object\"", + executeJavaScriptAndGetResult(getWebContents(), + "typeof window.frames[0].inner_ref")); + // Remove the iframe, this will trigger a removal of RenderFrame, which was causing + // the bug condition, as the transient object still has a holder -- the main window. + assertEquals("{}", + executeJavaScriptAndGetResult(getWebContents(), + "(function(){ " + + "var f = document.getElementById('frame');" + + "f.parentNode.removeChild(f); return f; })()")); + // Just in case, check that the remaining wrapper is still accessible. + assertEquals("\"object\"", + executeJavaScriptAndGetResult(getWebContents(), + "typeof inner_ref")); + } + private String executeJavaScriptAndGetResult(final WebContents webContents, final String script) throws Throwable { final String[] result = new String[1]; -- cgit v1.1