Skip to content

GitLab

T
tangled
Commit 92276c48 authored by Morten Stenshorne's avatar Morten Stenshorne Committed by Commit Bot
Browse files
Options

Don't load null URLs for OBJECT. 

When loading via ScheduleNavigation(), we didn't change null URLs to
about:blank.

The test is quite meaningless when it doesn't crash, so it's not
exported.

Bug: 930065
Change-Id: Ia23d30fe85720627d231a18d7b5f1dcf3927e9fa
Reviewed-on: https://chromium-review.googlesource.com/c/1459623Reviewed-by: default avatarDmitry Gozman <dgozman@chromium.org>
Commit-Queue: Morten Stenshorne <mstensho@chromium.org>
Cr-Commit-Position: refs/heads/master@{#633860}
parent 05eee3ed
Hide whitespace changes
Inline Side-by-side
Showing with 15 additions and 2 deletions
third_party/blink/renderer/core/html/html_frame_owner_element.cc
View file @ 92276c48
...@@ -365,12 +365,15 @@ bool HTMLFrameOwnerElement::LoadOrRedirectSubframe( ...@@ -365,12 +365,15 @@ bool HTMLFrameOwnerElement::LoadOrRedirectSubframe(
UpdateContainerPolicy(); UpdateContainerPolicy();
KURL url_to_request = url.IsNull() ? BlankURL() : url;
if (ContentFrame()) { if (ContentFrame()) {
// TODO(sclittle): Support lazily loading frame navigations. // TODO(sclittle): Support lazily loading frame navigations.
WebFrameLoadType frame_load_type = WebFrameLoadType::kStandard; WebFrameLoadType frame_load_type = WebFrameLoadType::kStandard;
if (replace_current_item) if (replace_current_item)
frame_load_type = WebFrameLoadType::kReplaceCurrentItem; frame_load_type = WebFrameLoadType::kReplaceCurrentItem;
ContentFrame()->ScheduleNavigation(GetDocument(), url, frame_load_type,
ContentFrame()->ScheduleNavigation(GetDocument(), url_to_request,
frame_load_type,
UserGestureStatus::kNone); UserGestureStatus::kNone);
return true; return true;
} }
...@@ -388,7 +391,7 @@ bool HTMLFrameOwnerElement::LoadOrRedirectSubframe( ...@@ -388,7 +391,7 @@ bool HTMLFrameOwnerElement::LoadOrRedirectSubframe(
if (!child_frame) if (!child_frame)
return false; return false;
ResourceRequest request(url.IsNull() ? BlankURL() : url); ResourceRequest request(url_to_request);
network::mojom::ReferrerPolicy policy = ReferrerPolicyAttribute(); network::mojom::ReferrerPolicy policy = ReferrerPolicyAttribute();
request.SetReferrerPolicy(policy); request.SetReferrerPolicy(policy);
......
third_party/blink/web_tests/fast/replaced/object-set-type-with-no-data-crash.html 0 → 100644
View file @ 92276c48
<!DOCTYPE html>
<object id="target" type="text/html"></object>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<script>
test(()=> {
var target = document.getElementById("target");
target.type = "text/html";
}, "No crash or DCHECK failure");
</script>
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment