Don't crash if a mousedown event handler detaches the document

Bug: 1083720 Test: fast/events/detach-frame-in-mousedown.html Change-Id: Ie44f1820756561af513595a1a2abefc3976ed889 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2208170 Commit-Queue: Kentaro Hara <haraken@chromium.org> Auto-Submit: Nate Chapin <japhet@chromium.org> Reviewed-by: Kentaro Hara <haraken@chromium.org> Cr-Commit-Position: refs/heads/master@{#769916}

Don't crash if a mousedown event handler detaches the document
Bug: 1083720 Test: fast/events/detach-frame-in-mousedown.html Change-Id: Ie44f1820756561af513595a1a2abefc3976ed889 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2208170 Commit-Queue: Kentaro Hara <haraken@chromium.org> Auto-Submit: Nate Chapin <japhet@chromium.org> Reviewed-by: Kentaro Hara <haraken@chromium.org> Cr-Commit-Position: refs/heads/master@{#769916}
0ff9b138 · Nate Chapin · Commit Bot · 16fd0811 · 0ff9b138 · 0ff9b138
Commit 0ff9b138 authored May 19, 2020 by Nate Chapin Committed by Commit Bot May 19, 2020
3 changed files
--- a/third_party/blink/renderer/core/input/event_handler.cc
+++ b/third_party/blink/renderer/core/input/event_handler.cc
@@ -843,10 +843,8 @@ WebInputEventResult EventHandler::HandleMousePressEvent(
      frame_, HitTestLocation(document_point),
      HitTestRequest::kReadOnly | HitTestRequest::kRetargetForInert);
  InputDeviceCapabilities* source_capabilities =
-      frame_->GetDocument()
-          ->domWindow()
-          ->GetInputDeviceCapabilities()
-          ->FiresTouchEvents(mouse_event.FromTouch());
+      frame_->DomWindow()->GetInputDeviceCapabilities()->FiresTouchEvents(
+          mouse_event.FromTouch());

  if (event_result == WebInputEventResult::kNotHandled) {
    event_result = mouse_event_manager_->HandleMouseFocus(hit_test_result,

--- a/third_party/blink/web_tests/fast/events/detach-frame-in-mousedown-expected.txt
+++ b/third_party/blink/web_tests/fast/events/detach-frame-in-mousedown-expected.txt
+PASS if no crash.
--- a/third_party/blink/web_tests/fast/events/detach-frame-in-mousedown.html
+++ b/third_party/blink/web_tests/fast/events/detach-frame-in-mousedown.html
+<body>
+PASS if no crash.
+<script src="../../resources/gesture-util.js"></script>
+<iframe id="i"></iframe>
+<script>
+if (window.testRunner) {
+  testRunner.dumpAsText();
+  testRunner.waitUntilDone();
+}
+
+
+async function test() {
+  var a = i.contentDocument.createElement('a');
+  a.onmousedown = () => i.remove();
+  a.appendChild(document.createTextNode('Click'));
+  i.contentDocument.body.appendChild(a);
+
+  await mouseDownAt(i.offsetLeft + a.offsetLeft + 7,
+                    i.offsetTop + a.offsetTop + 7);
+  if (window.testRunner)
+    testRunner.notifyDone();
+};
+test();
+</script>