80 lines
3.0 KiB
HTML
80 lines
3.0 KiB
HTML
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
|
|
<html>
|
|
<head>
|
|
<script src="../resources/js-test.js"></script>
|
|
</head>
|
|
<body id="body">
|
|
|
|
<div id="content" role="group">
|
|
<iframe id="frame" src="resources/frameset.html" onload="frameLoad();" width=500 height=500></iframe>
|
|
</div>
|
|
|
|
<p id="description"></p>
|
|
<div id="console"></div>
|
|
|
|
<script>
|
|
|
|
description("This tests that when we access a text marker in a frame that is subsequently replaced by a different frame, we don't leave a hanging node in the cache that leads to a crash.");
|
|
|
|
var loadCount = 0;
|
|
var markerRange = 0;
|
|
var string = 0;
|
|
|
|
function subFrameLoaded() {
|
|
|
|
// Step 2: When the sub frame of the iframe loads again this method is called (from that sub-frame)
|
|
|
|
// Access the old marker range that we kept hanging around and try to access after the frame changes. This should not crash.
|
|
var frame = accessibilityController.accessibleElementById("content");
|
|
var webArea = frame.childAtIndex(0).childAtIndex(0);
|
|
string = webArea.stringForTextMarkerRange(markerRange);
|
|
|
|
// Now try to access a node in the sub-frame, and then we'll replace the parent frame.
|
|
var text = frame.childAtIndex(0).childAtIndex(0).childAtIndex(0).childAtIndex(0).childAtIndex(0);
|
|
// Access a marker range so that we start tracking a node in our cache.
|
|
markerRange = text.textMarkerRangeForElement(text);
|
|
string = text.stringForTextMarkerRange(markerRange);
|
|
shouldBe("string", "'test text'");
|
|
|
|
// Step 3: Replace the top level iframe src while holding onto a marker range and verify there's no crash
|
|
document.getElementById("frame").onload = function() {
|
|
document.getElementById("content").removeChild(document.getElementById("frame"));
|
|
string = accessibilityController.accessibleElementById("content").stringForTextMarkerRange(markerRange);
|
|
|
|
debug("TEST PASSED: NO CRASH");
|
|
|
|
finishJSTest();
|
|
gc();
|
|
};
|
|
|
|
document.getElementById("frame").src = "resources/text.html";
|
|
|
|
gc();
|
|
}
|
|
|
|
function frameLoad() {
|
|
|
|
// Step 1: When the iframe loads get a marker range that is reference is the sub-frame of the iframe.
|
|
var frame = accessibilityController.accessibleElementById("content");
|
|
|
|
var text = frame.childAtIndex(0).childAtIndex(0).childAtIndex(0).childAtIndex(0).childAtIndex(0).childAtIndex(0);
|
|
|
|
// Access a marker range so that we start tracking a node in our cache.
|
|
markerRange = text.textMarkerRangeForElement(text);
|
|
string = text.stringForTextMarkerRange(markerRange);
|
|
|
|
shouldBe("string", "'hello'");
|
|
gc();
|
|
|
|
// Load a new frame in this location which should now invalidate the marker range cache (and not lead to a crash).
|
|
document.getElementById("frame").contentWindow.frames[0].location = "resources/inform-parent-of-load.html";
|
|
|
|
gc();
|
|
}
|
|
|
|
jsTestIsAsync = true;
|
|
|
|
</script>
|
|
</body>
|
|
</html>
|