haikuwebkit/LayoutTests/accessibility/frame-disconnect-textmarker...

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<script src="../resources/js-test.js"></script>
</head>
<body id="body">

<div id="content" role="group">
<iframe id="frame" src="resources/frameset.html" onload="frameLoad();" width=500 height=500></iframe>
</div>

<p id="description"></p>
<div id="console"></div>

<script>

    description("This tests that when we access a text marker in a frame that is subsequently replaced by a different frame, we don't leave a hanging node in the cache that leads to a crash.");

    var loadCount = 0;
    var markerRange = 0;
    var string = 0;

    function subFrameLoaded() {

        // Step 2: When the sub frame of the iframe loads again this method is called (from that sub-frame)

        // Access the old marker range that we kept hanging around and try to access after the frame changes. This should not crash.
        var frame = accessibilityController.accessibleElementById("content");
        var webArea = frame.childAtIndex(0).childAtIndex(0);
        string = webArea.stringForTextMarkerRange(markerRange);

        // Now try to access a node in the sub-frame, and then we'll replace the parent frame.
        var text = frame.childAtIndex(0).childAtIndex(0).childAtIndex(0).childAtIndex(0).childAtIndex(0);
        // Access a marker range so that we start tracking a node in our cache.
        markerRange = text.textMarkerRangeForElement(text);
        string = text.stringForTextMarkerRange(markerRange);
        shouldBe("string", "'test text'");

        // Step 3: Replace the top level iframe src while holding onto a marker range and verify there's no crash
        document.getElementById("frame").onload = function() {
            document.getElementById("content").removeChild(document.getElementById("frame"));
            string = accessibilityController.accessibleElementById("content").stringForTextMarkerRange(markerRange);

            debug("TEST PASSED: NO CRASH");

            finishJSTest();
            gc();
        };

        document.getElementById("frame").src = "resources/text.html";

        gc();
    }

    function frameLoad() {

        // Step 1: When the iframe loads get a marker range that is reference is the sub-frame of the iframe.
        var frame = accessibilityController.accessibleElementById("content");

        var text = frame.childAtIndex(0).childAtIndex(0).childAtIndex(0).childAtIndex(0).childAtIndex(0).childAtIndex(0);
      
        // Access a marker range so that we start tracking a node in our cache.
        markerRange = text.textMarkerRangeForElement(text);
        string = text.stringForTextMarkerRange(markerRange);

        shouldBe("string", "'hello'"); 
        gc();

        // Load a new frame in this location which should now invalidate the marker range cache (and not lead to a crash).
        document.getElementById("frame").contentWindow.frames[0].location = "resources/inform-parent-of-load.html";

        gc();
    }

    jsTestIsAsync = true;

</script>
</body>
</html>