| <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN"> |
| <html> |
| <head> |
| <script src="../resources/js-test.js"></script> |
| </head> |
| <body id="body"> |
| |
| <div id="content" role="group"> |
| <iframe id="frame" src="resources/frameset.html" onload="frameLoad();" width=500 height=500></iframe> |
| </div> |
| |
| <p id="description"></p> |
| <div id="console"></div> |
| |
| <script> |
| |
| description("This tests that when we access a text marker in a frame that is subsequently replaced by a different frame, we don't leave a hanging node in the cache that leads to a crash."); |
| |
| var loadCount = 0; |
| var markerRange = 0; |
| var string = 0; |
| |
| function subFrameLoaded() { |
| |
| // Step 2: When the sub frame of the iframe loads again this method is called (from that sub-frame) |
| |
| // Access the old marker range that we kept hanging around and try to access after the frame changes. This should not crash. |
| var frame = accessibilityController.accessibleElementById("content"); |
| var webArea = frame.childAtIndex(0).childAtIndex(0); |
| string = webArea.stringForTextMarkerRange(markerRange); |
| |
| // Now try to access a node in the sub-frame, and then we'll replace the parent frame. |
| var text = frame.childAtIndex(0).childAtIndex(0).childAtIndex(0).childAtIndex(0).childAtIndex(0); |
| // Access a marker range so that we start tracking a node in our cache. |
| markerRange = text.textMarkerRangeForElement(text); |
| string = text.stringForTextMarkerRange(markerRange); |
| shouldBe("string", "'test text'"); |
| |
| // Step 3: Replace the top level iframe src while holding onto a marker range and verify there's no crash |
| document.getElementById("frame").onload = function() { |
| document.getElementById("content").removeChild(document.getElementById("frame")); |
| string = accessibilityController.accessibleElementById("content").stringForTextMarkerRange(markerRange); |
| |
| debug("TEST PASSED: NO CRASH"); |
| |
| finishJSTest(); |
| gc(); |
| }; |
| |
| document.getElementById("frame").src = "resources/text.html"; |
| |
| gc(); |
| } |
| |
| function frameLoad() { |
| |
| // Step 1: When the iframe loads get a marker range that is reference is the sub-frame of the iframe. |
| var frame = accessibilityController.accessibleElementById("content"); |
| |
| var text = frame.childAtIndex(0).childAtIndex(0).childAtIndex(0).childAtIndex(0).childAtIndex(0).childAtIndex(0); |
| |
| // Access a marker range so that we start tracking a node in our cache. |
| markerRange = text.textMarkerRangeForElement(text); |
| string = text.stringForTextMarkerRange(markerRange); |
| |
| shouldBe("string", "'hello'"); |
| gc(); |
| |
| // Load a new frame in this location which should now invalidate the marker range cache (and not lead to a crash). |
| document.getElementById("frame").contentWindow.frames[0].location = "resources/inform-parent-of-load.html"; |
| |
| gc(); |
| } |
| |
| jsTestIsAsync = true; |
| |
| </script> |
| </body> |
| </html> |
