destroy-middle-click-locked-target-crash.html

<!DOCTYPE html>
<html>
<title>Clear middle click target if target is destroyed when autoscroll is in progress</title>
<style>
#target-iframe1 {
  height: 100px;
  width: 100px;
  overflow-y: scroll;
  position: absolute;
  left: 100px;
  top: 100px;
}
</style>
<script>
  let iframeLoadCount = 0;

  function onIframeLoad(){
    // Increment the count each time iframe is loaded.
    iframeLoadCount = iframeLoadCount+1;
  }
</script>
<body>
  PASS if no crash.
<div id="container" style="height: 400px; width: 400px; overflow: auto">
    <div id="filler" style="height:4000px; width: 4000px"></div>
<iframe id="target-iframe1" onload="onIframeLoad()"
  src= "http://localhost:8000/misc/resources/cross-origin-subframe-for-scrolling.html">
</iframe>
</div>
</body>
</html>
<script src='/js-test-resources/gesture-util.js'></script>
<script>
  let iframeScrolled = false;

  async function runTest() {
    // On document load, perform middle click on the iframe to start the
    // autoscroll. When middle click autoscroll is in progress on iframe,
    // navigate iframe to another cross-domain url and perform mouse move
    // on root frame. If the bug (crbug.com/1007983) repros, it will crash
    // the process.
    const container = document.getElementById('container');
    const subFrame = document.getElementsByTagName('iframe')[0];
    const startx = subFrame.offsetLeft + (subFrame.offsetWidth / 2);
    const starty = subFrame.offsetTop;

    // move the mouse inside the iframe.
    await mouseMoveTo(startx + 10 , starty + 10);
    // middle click in iframe to start autoscroll.
    await mouseClickOn(startx + 10, starty + 10, 1);
    await mouseMoveTo(startx + 10, starty + 30);

    //wait for the iframe to scroll.
    await waitFor(() => {
        return (iframeScrolled === true);
    });

    if (iframeLoadCount != 1) {
      document.body.innterHTML = `FAIL: iframeLoadCount=${iframeLoadCount}`;
      testRunner.notifyDone();
      return;
    }

    // Change the source of iframe to naviagate to a cross-domain url,
    // so it will destory the view.
    subFrame.src = 'about:blank';

    // Wait for the iframe to load.
     await waitFor(() => {
       return (iframeLoadCount === 2);
    });

    // Perform mouse event on root frame. If the bug repros, renderer will
    // crash.
    await mouseMoveTo(10, 10);
    testRunner.notifyDone();
  }

  async function setup() {
    if (!window.testRunner)
      return;
    testRunner.dumpAsText();
    runTest();
    testRunner.waitUntilDone();
  }
  window.onload = setup;

  window.addEventListener("message", handleMessage);

  function handleMessage(event){
    if(event.data.scrollTop > 0) {
      iframeScrolled = true;
    }
  }
</script>
chromium/third_party/blink/web_tests/http/tests/misc/destroy-middle-click-locked-target-crash.html
