new webkit_browsertest for crbug.com/103058

Unfortunately, I haven't been able to reproduce bug 103058 very well in WebKit's LayoutTest engine, because DumpRenderTree's libraries interfere with resource lifetime; a browser_test doesn't have this issue, so it's able to act as a good regression test for this issue. BUG=103058 Review URL: http://codereview.chromium.org/8531002 git-svn-id: svn://svn.chromium.org/chrome/trunk/src@110321 0039d316-1c4b-4281-b951-d872f2087c98

new webkit_browsertest for crbug.com/103058
Unfortunately, I haven't been able to reproduce bug 103058 very well in WebKit's LayoutTest engine, because DumpRenderTree's libraries interfere with resource lifetime; a browser_test doesn't have this issue, so it's able to act as a good regression test for this issue. BUG=103058 Review URL: http://codereview.chromium.org/8531002 git-svn-id: svn://svn.chromium.org/chrome/trunk/src@110321 0039d316-1c4b-4281-b951-d872f2087c98
090e47de · gavinp@chromium.org · 35a3aaac · 090e47de · 090e47de · 090e47de
Commit 090e47de authored Nov 16, 2011 by gavinp@chromium.org
4 changed files
--- a/chrome/test/data/webkit/resources/xslt-bad-import-uri.xml
+++ b/chrome/test/data/webkit/resources/xslt-bad-import-uri.xml
+<?xml version='1.0' encoding="UTF-8" ?>
+<?xml-stylesheet type="text/xsl" href="xslt-bad-import-uri.xsl"?>
+<catalog> 
+</catalog> 
--- a/chrome/test/data/webkit/resources/xslt-bad-import-uri.xsl
+++ b/chrome/test/data/webkit/resources/xslt-bad-import-uri.xsl
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+<xsl:import href="nosuchfileatall"/>
+<xsl:template match="/">
+ <xsl:apply-imports/>
+</xsl:template>
+</xsl:stylesheet>
--- a/chrome/test/data/webkit/xslt-bad-import.html
+++ b/chrome/test/data/webkit/xslt-bad-import.html
+<html>
+  <head>
+    <script>
+      window.onload = function() {
+        document.getElementById('d').innerHTML=''
+      }
+    </script>
+  </head>
+  <body>
+    <span id="d">
+      <iframe src="resources/xslt-bad-import-uri.xml"></iframe>
+    </span>
+  </body>
+</html>
--- a/content/browser/webkit_browsertest.cc
+++ b/content/browser/webkit_browsertest.cc
@@ -34,3 +34,23 @@ IN_PROC_BROWSER_TEST_F(WebKitBrowserTest, AbortOnEnd) {
  EXPECT_FALSE(tab_contents->is_crashed());
 }

+// This is a browser test because the DumpRenderTree framework holds
+// onto a Document* reference that blocks this reproduction from
+// destroying the Document, so it is not a use after free unless
+// you don't have DumpRenderTree loaded.
+
+// TODO(gavinp): remove this browser_test if we can get good LayoutTest
+// coverage of the same issue.
+const char kXsltBadImportPage[] =
+    "files/webkit/xslt-bad-import.html";
+IN_PROC_BROWSER_TEST_F(WebKitBrowserTest, XsltBadImport) {
+  ASSERT_TRUE(test_server()->Start());
+  URLRequestAbortOnEndJob::AddUrlHandler();
+  GURL url = test_server()->GetURL(kXsltBadImportPage);
+
+  ui_test_utils::NavigateToURL(browser(), url);
+
+  TabContents* tab_contents = browser()->GetSelectedTabContents();
+  EXPECT_FALSE(tab_contents->is_crashed());
+}
+