Fix null dereference in HTMLAnchorElement::sendPings when frame is not attached to...
authorrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 13 Aug 2013 06:38:55 +0000 (06:38 +0000)
committerrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 13 Aug 2013 06:38:55 +0000 (06:38 +0000)
https://bugs.webkit.org/show_bug.cgi?id=119716

Reviewed by Darin Adler.

Add a regression test for r153975.

* fast/html/detach-frame-while-clicking-on-anchor-with-ping-expected.txt: Added.
* fast/html/detach-frame-while-clicking-on-anchor-with-ping.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@153982 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/fast/html/detach-frame-while-clicking-on-anchor-with-ping-expected.txt [new file with mode: 0644]
LayoutTests/fast/html/detach-frame-while-clicking-on-anchor-with-ping.html [new file with mode: 0644]

index c5caa5ea3853181a0af536287ce7ef3e1e2ff76f..f98b387852a9876a9d5418940f3a50b44a83cffa 100644 (file)
@@ -1,3 +1,15 @@
+2013-08-12  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Fix null dereference in HTMLAnchorElement::sendPings when frame is not attached to a page
+        https://bugs.webkit.org/show_bug.cgi?id=119716
+
+        Reviewed by Darin Adler.
+
+        Add a regression test for r153975.
+
+        * fast/html/detach-frame-while-clicking-on-anchor-with-ping-expected.txt: Added.
+        * fast/html/detach-frame-while-clicking-on-anchor-with-ping.html: Added.
+
 2013-08-12  Zan Dobersek  <zdobersek@igalia.com>
 
         ASSERTION FAILED: type() == Percent in WebCore::Length::percent
diff --git a/LayoutTests/fast/html/detach-frame-while-clicking-on-anchor-with-ping-expected.txt b/LayoutTests/fast/html/detach-frame-while-clicking-on-anchor-with-ping-expected.txt
new file mode 100644 (file)
index 0000000..6bd284b
--- /dev/null
@@ -0,0 +1,4 @@
+This tests detaching a frame while clicking on an anchor element with ping attribute in the frame.
+WebKit should not crash.
+
+PASS. WebKit did not crash.
diff --git a/LayoutTests/fast/html/detach-frame-while-clicking-on-anchor-with-ping.html b/LayoutTests/fast/html/detach-frame-while-clicking-on-anchor-with-ping.html
new file mode 100644 (file)
index 0000000..cff490b
--- /dev/null
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p id="description">This tests detaching a frame while clicking on an anchor element with ping attribute in the frame.<br>
+WebKit should not crash.</p>
+<script>
+
+if (window.testRunner)
+    testRunner.dumpAsText();
+
+var iframe = document.createElement('iframe');
+document.body.appendChild(iframe);
+var anchorElement = iframe.contentDocument.createElement('a');
+anchorElement.setAttribute('href', 'javascript:parent.remove(event);');
+anchorElement.setAttribute('ping', 'https://webkit.org/');
+iframe.contentDocument.body.appendChild(anchorElement);
+
+function remove(event) {
+    iframe.parentNode.removeChild(iframe);
+    event.preventDefault();
+}
+
+anchorElement.click();
+document.write('PASS. WebKit did not crash.');
+
+</script>
+</body>
+</html>