Attachment 339456 Details for Bug 185238 – Patch for landing

[patch] Patch for landing

bug-185238-20180503135453.patch (text/plain), 22.86 KB, created by Ryosuke Niwa on 2018-05-03 13:54:54 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Ryosuke Niwa

Created: 2018-05-03 13:54:54 PDT

Size: 22.86 KB

patch

obsolete

>Index: Source/WebCore/ChangeLog
>===================================================================
>--- Source/WebCore/ChangeLog	(revision 231325)
>+++ Source/WebCore/ChangeLog	(working copy)
>@@ -1,3 +1,42 @@
>+2018-05-03  Ryosuke Niwa  <rniwa@webkit.org>
>+
>+        Using image map inside a shadow tree results hits a release assert in DocumentOrderedMap::add
>+        https://bugs.webkit.org/show_bug.cgi?id=185238
>+
>+        Reviewed by Antti Koivisto.
>+
>+        The bug was caused by DocumentOrderedMap for the image elements with usemap being stored in Document
>+        even if those image elements were in a shadow tree. Fixed the bug by moving the map to TreeScope.
>+
>+        Test: fast/images/imagemap-in-nested-shadow-tree.html
>+              fast/images/imagemap-in-shadow-tree.html
>+
>+        * dom/Document.cpp:
>+        (WebCore::Document::addImageElementByUsemap): Moved to TreeScope.
>+        (WebCore::Document::removeImageElementByUsemap): Ditto.
>+        (WebCore::Document::imageElementByUsemap const): Ditto.
>+        * dom/Document.h:
>+        * dom/TreeScope.cpp:
>+        (WebCore::TreeScope::destroyTreeScopeData): Clear m_imagesByUsemap as well as m_elementsByName.
>+        (WebCore::TreeScope::getImageMap const): Removed the code to parse usemap. RenderImage::imageMap()
>+        which used to call this function with the raw value of the usemap content attribute now calls it
>+        via HTMLImageElement::associatedMapElement(), which uses the parsed usemap.
>+        (WebCore::TreeScope::addImageElementByUsemap): Moved from Document.
>+        (WebCore::TreeScope::removeImageElementByUsemap): Ditto.
>+        (WebCore::TreeScope::imageElementByUsemap const): Ditto.
>+        * dom/TreeScope.h:
>+        * html/HTMLImageElement.cpp:
>+        (WebCore::HTMLImageElement::parseAttribute):
>+        (WebCore::HTMLImageElement::insertedIntoAncestor): This image element can be associated with a map element
>+        if it's connected to a document.
>+        (WebCore::HTMLImageElement::removedFromAncestor):
>+        (WebCore::HTMLImageElement::associatedMapElement const):
>+        * html/HTMLImageElement.h:
>+        * html/HTMLMapElement.cpp:
>+        (WebCore::HTMLMapElement::imageElement):
>+        * rendering/RenderImage.cpp:
>+        (WebCore::RenderImage::imageMap const):
>+
> 2018-05-03  Chris Nardi  <cnardi@chromium.org>
> 
>         Remove [NoInterfaceObject] from DOMRectList
>Index: Source/WebCore/dom/Document.cpp
>===================================================================
>--- Source/WebCore/dom/Document.cpp	(revision 231325)
>+++ Source/WebCore/dom/Document.cpp	(working copy)
>@@ -743,21 +743,6 @@ void Document::invalidateAccessKeyMap()
>     m_elementsByAccessKey.clear();
> }
> 
>-void Document::addImageElementByUsemap(const AtomicStringImpl& name, HTMLImageElement& element)
>-{
>-    return m_imagesByUsemap.add(name, element, *this);
>-}
>-
>-void Document::removeImageElementByUsemap(const AtomicStringImpl& name, HTMLImageElement& element)
>-{
>-    return m_imagesByUsemap.remove(name, element);
>-}
>-
>-HTMLImageElement* Document::imageElementByUsemap(const AtomicStringImpl& name) const
>-{
>-    return m_imagesByUsemap.getElementByUsemap(name, *this);
>-}
>-
> ExceptionOr<SelectorQuery&> Document::selectorQueryForString(const String& selectorString)
> {
>     if (selectorString.isEmpty())
>Index: Source/WebCore/dom/Document.h
>===================================================================
>--- Source/WebCore/dom/Document.h	(revision 231325)
>+++ Source/WebCore/dom/Document.h	(working copy)
>@@ -381,10 +381,6 @@ public:
>     Element* getElementByAccessKey(const String& key);
>     void invalidateAccessKeyMap();
> 
>-    void addImageElementByUsemap(const AtomicStringImpl&, HTMLImageElement&);
>-    void removeImageElementByUsemap(const AtomicStringImpl&, HTMLImageElement&);
>-    HTMLImageElement* imageElementByUsemap(const AtomicStringImpl&) const;
>-
>     ExceptionOr<SelectorQuery&> selectorQueryForString(const String&);
>     void clearSelectorQueryCache();
> 
>@@ -1682,8 +1678,6 @@ private:
> 
>     HashMap<StringImpl*, Element*, ASCIICaseInsensitiveHash> m_elementsByAccessKey;
> 
>-    DocumentOrderedMap m_imagesByUsemap;
>-
>     std::unique_ptr<ConstantPropertyMap> m_constantPropertyMap;
> 
>     std::unique_ptr<SelectorQueryCache> m_selectorQueryCache;
>Index: Source/WebCore/dom/TreeScope.cpp
>===================================================================
>--- Source/WebCore/dom/TreeScope.cpp	(revision 231325)
>+++ Source/WebCore/dom/TreeScope.cpp	(working copy)
>@@ -35,6 +35,7 @@
> #include "FrameView.h"
> #include "HTMLAnchorElement.h"
> #include "HTMLFrameOwnerElement.h"
>+#include "HTMLImageElement.h"
> #include "HTMLLabelElement.h"
> #include "HTMLMapElement.h"
> #include "HitTestResult.h"
>@@ -52,7 +53,7 @@
> namespace WebCore {
> 
> struct SameSizeAsTreeScope {
>-    void* pointers[8];
>+    void* pointers[9];
> };
> 
> COMPILE_ASSERT(sizeof(TreeScope) == sizeof(SameSizeAsTreeScope), treescope_should_stay_small);
>@@ -82,7 +83,9 @@ TreeScope::~TreeScope() = default;
> void TreeScope::destroyTreeScopeData()
> {
>     m_elementsById = nullptr;
>+    m_elementsByName = nullptr;
>     m_imageMapsByName = nullptr;
>+    m_imagesByUsemap = nullptr;
>     m_labelsByForAttribute = nullptr;
> }
> 
>@@ -250,17 +253,32 @@ void TreeScope::removeImageMap(HTMLMapEl
>     m_imageMapsByName->remove(*name, imageMap);
> }
> 
>-HTMLMapElement* TreeScope::getImageMap(const String& url) const
>+HTMLMapElement* TreeScope::getImageMap(const AtomicString& name) const
> {
>-    if (!m_imageMapsByName)
>-        return nullptr;
>-    auto hashPosition = url.find('#');
>-    if (hashPosition == notFound)
>+    if (!m_imageMapsByName || !name.impl())
>         return nullptr;
>-    String name = url.substring(hashPosition + 1);
>-    if (name.isEmpty())
>+    return m_imageMapsByName->getElementByMapName(*name.impl(), *this);
>+}
>+
>+void TreeScope::addImageElementByUsemap(const AtomicStringImpl& name, HTMLImageElement& element)
>+{
>+    if (!m_imagesByUsemap)
>+        m_imagesByUsemap = std::make_unique<DocumentOrderedMap>();
>+    return m_imagesByUsemap->add(name, element, *this);
>+}
>+
>+void TreeScope::removeImageElementByUsemap(const AtomicStringImpl& name, HTMLImageElement& element)
>+{
>+    if (!m_imagesByUsemap)
>+        return;
>+    m_imagesByUsemap->remove(name, element);
>+}
>+
>+HTMLImageElement* TreeScope::imageElementByUsemap(const AtomicStringImpl& name) const
>+{
>+    if (!m_imagesByUsemap)
>         return nullptr;
>-    return m_imageMapsByName->getElementByMapName(*AtomicString(name).impl(), *this);
>+    return m_imagesByUsemap->getElementByUsemap(name, *this);
> }
> 
> void TreeScope::addLabel(const AtomicStringImpl& forAttributeValue, HTMLLabelElement& element)
>Index: Source/WebCore/dom/TreeScope.h
>===================================================================
>--- Source/WebCore/dom/TreeScope.h	(revision 231325)
>+++ Source/WebCore/dom/TreeScope.h	(working copy)
>@@ -37,6 +37,7 @@ namespace WebCore {
> class ContainerNode;
> class Document;
> class Element;
>+class HTMLImageElement;
> class HTMLLabelElement;
> class HTMLMapElement;
> class LayoutPoint;
>@@ -80,7 +81,11 @@ public:
> 
>     void addImageMap(HTMLMapElement&);
>     void removeImageMap(HTMLMapElement&);
>-    HTMLMapElement* getImageMap(const String& url) const;
>+    HTMLMapElement* getImageMap(const AtomicString&) const;
>+
>+    void addImageElementByUsemap(const AtomicStringImpl&, HTMLImageElement&);
>+    void removeImageElementByUsemap(const AtomicStringImpl&, HTMLImageElement&);
>+    HTMLImageElement* imageElementByUsemap(const AtomicStringImpl&) const;
> 
>     // For accessibility.
>     bool shouldCacheLabelsByForAttribute() const { return !!m_labelsByForAttribute; }
>@@ -124,6 +129,7 @@ private:
>     std::unique_ptr<DocumentOrderedMap> m_elementsById;
>     std::unique_ptr<DocumentOrderedMap> m_elementsByName;
>     std::unique_ptr<DocumentOrderedMap> m_imageMapsByName;
>+    std::unique_ptr<DocumentOrderedMap> m_imagesByUsemap;
>     std::unique_ptr<DocumentOrderedMap> m_labelsByForAttribute;
> 
>     std::unique_ptr<IdTargetObserverRegistry> m_idTargetObserverRegistry;
>Index: Source/WebCore/html/HTMLImageElement.cpp
>===================================================================
>--- Source/WebCore/html/HTMLImageElement.cpp	(revision 231325)
>+++ Source/WebCore/html/HTMLImageElement.cpp	(working copy)
>@@ -32,6 +32,7 @@
> #include "HTMLFormElement.h"
> #include "HTMLParserIdioms.h"
> #include "HTMLPictureElement.h"
>+#include "HTMLMapElement.h"
> #include "HTMLSourceElement.h"
> #include "HTMLSrcsetParser.h"
> #include "Logging.h"
>@@ -211,12 +212,12 @@ void HTMLImageElement::parseAttribute(co
>         selectImageSource();
>     else if (name == usemapAttr) {
>         if (isConnected() && !m_parsedUsemap.isNull())
>-            document().removeImageElementByUsemap(*m_parsedUsemap.impl(), *this);
>+            treeScope().removeImageElementByUsemap(*m_parsedUsemap.impl(), *this);
> 
>         m_parsedUsemap = parseHTMLHashNameReference(value);
> 
>         if (isConnected() && !m_parsedUsemap.isNull())
>-            document().addImageElementByUsemap(*m_parsedUsemap.impl(), *this);
>+            treeScope().addImageElementByUsemap(*m_parsedUsemap.impl(), *this);
>     } else if (name == compositeAttr) {
>         // FIXME: images don't support blend modes in their compositing attribute.
>         BlendMode blendOp = BlendModeNormal;
>@@ -320,7 +321,7 @@ Node::InsertedIntoAncestorResult HTMLIma
>     Node::InsertedIntoAncestorResult insertNotificationRequest = HTMLElement::insertedIntoAncestor(insertionType, parentOfInsertedTree);
> 
>     if (insertionType.connectedToDocument && !m_parsedUsemap.isNull())
>-        document().addImageElementByUsemap(*m_parsedUsemap.impl(), *this);
>+        treeScope().addImageElementByUsemap(*m_parsedUsemap.impl(), *this);
> 
>     if (is<HTMLPictureElement>(parentNode())) {
>         setPictureElement(&downcast<HTMLPictureElement>(*parentNode()));
>@@ -341,7 +342,7 @@ void HTMLImageElement::removedFromAncest
>         m_form->removeImgElement(this);
> 
>     if (removalType.disconnectedFromDocument && !m_parsedUsemap.isNull())
>-        document().removeImageElementByUsemap(*m_parsedUsemap.impl(), *this);
>+        treeScope().removeImageElementByUsemap(*m_parsedUsemap.impl(), *this);
> 
>     if (is<HTMLPictureElement>(parentNode()))
>         setPictureElement(nullptr);
>@@ -484,6 +485,11 @@ bool HTMLImageElement::matchesUsemap(con
>     return m_parsedUsemap.impl() == &name;
> }
> 
>+HTMLMapElement* HTMLImageElement::associatedMapElement() const
>+{
>+    return treeScope().getImageMap(m_parsedUsemap);
>+}
>+
> const AtomicString& HTMLImageElement::alt() const
> {
>     return attributeWithoutSynchronization(altAttr);
>Index: Source/WebCore/html/HTMLImageElement.h
>===================================================================
>--- Source/WebCore/html/HTMLImageElement.h	(revision 231325)
>+++ Source/WebCore/html/HTMLImageElement.h	(working copy)
>@@ -32,6 +32,7 @@
> namespace WebCore {
> 
> class HTMLFormElement;
>+class HTMLMapElement;
> 
> struct ImageCandidate;
> 
>@@ -63,6 +64,7 @@ public:
>     void setLoadManually(bool loadManually) { m_imageLoader.setLoadManually(loadManually); }
> 
>     bool matchesUsemap(const AtomicStringImpl&) const;
>+    HTMLMapElement* associatedMapElement() const;
> 
>     WEBCORE_EXPORT const AtomicString& alt() const;
> 
>Index: Source/WebCore/html/HTMLMapElement.cpp
>===================================================================
>--- Source/WebCore/html/HTMLMapElement.cpp	(revision 231325)
>+++ Source/WebCore/html/HTMLMapElement.cpp	(working copy)
>@@ -80,7 +80,7 @@ HTMLImageElement* HTMLMapElement::imageE
> {
>     if (m_name.isEmpty())
>         return nullptr;
>-    return document().imageElementByUsemap(*m_name.impl());
>+    return treeScope().imageElementByUsemap(*m_name.impl());
> }
> 
> void HTMLMapElement::parseAttribute(const QualifiedName& name, const AtomicString& value)
>Index: Source/WebCore/rendering/RenderImage.cpp
>===================================================================
>--- Source/WebCore/rendering/RenderImage.cpp	(revision 231325)
>+++ Source/WebCore/rendering/RenderImage.cpp	(working copy)
>@@ -656,8 +656,10 @@ LayoutUnit RenderImage::minimumReplacedH
> 
> HTMLMapElement* RenderImage::imageMap() const
> {
>-    HTMLImageElement* image = is<HTMLImageElement>(element()) ? downcast<HTMLImageElement>(element()) : nullptr;
>-    return image ? image->treeScope().getImageMap(image->attributeWithoutSynchronization(usemapAttr)) : nullptr;
>+    auto* imageElement = element();
>+    if (!imageElement || !is<HTMLImageElement>(imageElement))
>+        return nullptr;
>+    return downcast<HTMLImageElement>(imageElement)->associatedMapElement();
> }
> 
> bool RenderImage::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, const HitTestLocation& locationInContainer, const LayoutPoint& accumulatedOffset, HitTestAction hitTestAction)
>Index: LayoutTests/ChangeLog
>===================================================================
>--- LayoutTests/ChangeLog	(revision 231325)
>+++ LayoutTests/ChangeLog	(working copy)
>@@ -1,3 +1,15 @@
>+2018-05-03  Ryosuke Niwa  <rniwa@webkit.org>
>+
>+        Using image map inside a shadow tree results hits a release assert in DocumentOrderedMap::add
>+        https://bugs.webkit.org/show_bug.cgi?id=185238
>+
>+        Reviewed by Antti Koivisto.
>+
>+        * fast/images/imagemap-in-nested-shadow-tree-expected.txt: Added.
>+        * fast/images/imagemap-in-nested-shadow-tree.html: Added.
>+        * fast/images/imagemap-in-shadow-tree-expected.txt: Added.
>+        * fast/images/imagemap-in-shadow-tree.html: Added.
>+
> 2018-05-03  Ryan Haddad  <ryanhaddad@apple.com>
> 
>         Mark media/controls/pip-placeholder-without-video-controls.html as flaky.
>Index: LayoutTests/fast/images/imagemap-in-shadow-tree-expected.txt
>===================================================================
>--- LayoutTests/fast/images/imagemap-in-shadow-tree-expected.txt	(nonexistent)
>+++ LayoutTests/fast/images/imagemap-in-shadow-tree-expected.txt	(working copy)
>@@ -0,0 +1,5 @@
>+This tests activing an image map area inside a shadow tree. WebKit should not hit any assertions.
>+To manually test, click on green box on the left upper quadrant.
>+
>+PASS
>+
>Index: LayoutTests/fast/images/imagemap-in-shadow-tree.html
>===================================================================
>--- LayoutTests/fast/images/imagemap-in-shadow-tree.html	(nonexistent)
>+++ LayoutTests/fast/images/imagemap-in-shadow-tree.html	(working copy)
>@@ -0,0 +1,71 @@
>+<!DOCTYPE html>
>+<html>
>+<body>
>+<script src="../../resources/ui-helper.js"></script>
>+<p>This tests activing an image map area inside a shadow tree. WebKit should not hit any assertions.<br>
>+To manually test, click on green box on the left upper quadrant.</p>
>+<div id="result"></div>
>+<script>
>+
>+const host = document.createElement('div');
>+document.body.appendChild(host);
>+
>+const shadowRoot = host.attachShadow({mode: 'closed'});
>+shadowRoot.innerHTML = `
>+<img src="resources/green-400x400.png" width="400" height="400" usemap="#imagemap" onload="startTest()">
>+<map name="imagemap">
>+    <area id="area" shape="rect" coords="0,0,200,200" href="#" onclick="didClick(event)" tabindex="0">
>+</map>`;
>+const rect = host.getBoundingClientRect();
>+
>+function startTest()
>+{
>+    if (!window.testRunner)
>+        return;
>+    UIHelper.activateAt(rect.x + 100, rect.y + 100).then(check);
>+}
>+
>+let didClickWasCalled = false;
>+function didClick(event)
>+{
>+    event.preventDefault();
>+    didClickWasCalled = true;
>+}
>+
>+function check()
>+{
>+    let result = '';
>+    if (!didClickWasCalled)
>+        result = 'FAIL - JavaScript was not executed';
>+    else if (shadowRoot.activeElement != shadowRoot.getElementById('area'))
>+        result = 'FAIL - The element was not focused';
>+    else
>+        result = 'PASS';
>+    document.getElementById('result').textContent = result;
>+    if (window.testRunner)
>+        testRunner.notifyDone();
>+}
>+
>+if (window.testRunner) {
>+    setTimeout(() => testRunner.notifyDone(), 3000);
>+    testRunner.waitUntilDone();
>+    testRunner.dumpAsText();
>+} else {
>+    host.onclick = (event) => {
>+        event.preventDefault();
>+
>+        const isInUpperLeftQuadrant = rect.x < event.pageX && event.pageX < rect.x + 200
>+            && rect.y < event.pageY && event.pageY < rect.y + 200;
>+        if (!isInUpperLeftQuadrant) {
>+            alert('Please click on the upper left quadrant of the green box.');
>+            return;
>+        }
>+
>+        check();
>+    };
>+}
>+
>+</script>
>+</body>
>+</head>
>+</html>
>Index: LayoutTests/http/tests/media/video-play-stall.html
>===================================================================
>--- LayoutTests/http/tests/media/video-play-stall.html	(revision 231325)
>+++ LayoutTests/http/tests/media/video-play-stall.html	(working copy)
>@@ -1,45 +1,127 @@
> <!DOCTYPE html>
> <html>
>-    <head>
>-        <title>'stalled' event test</title>
>-        <script src=../../media-resources/media-file.js></script>
>-        <script src=../../media-resources/video-test.js></script>
>-        <script>
>-
>-            var playCount = 0;
>-
>-            function start() 
>-            {
>-                findMediaElement();
>-                waitForEvent('durationchange');
>-                waitForEvent('loadedmetadata');
>-                waitForEvent('loadeddata');
>-
>-                mediaElement.addEventListener('canplay', function () {
>-                    // 'stalled' takes three seconds to fire, so 'canplay' may fire more than once
>-                    // depending on how the engine parses incoming media data.
>-                    if (++playCount > 1)
>-                        return;
>-                    consoleWrite("EVENT(canplay)");
>-                    run("video.play()");
>-                } );
>-
>-                waitForEvent('stalled', function () {
>-                    testExpected("video.currentTime", 0, "!=");
>-                    testExpected("video.playbackRate", 1, "===");
>-                    testExpected("video.paused", false, "===");
>-                    endTest();
>-                } );
>-
>-                var mediaFile = findMediaFile("video", "../../../../media/content/long-test");
>-                var mimeType = mimeTypeForFile(mediaFile);
>-                video.src = "http://127.0.0.1:8000/media/resources/serve-video.php?name=" + mediaFile + "&type=" + mimeType + "&stallOffset=100000&stallDuration=60&chunkSize=1024";
>-            }
>-
>-        </script>
>-    </head>
>-    <body onload="setTimeout(start, 0)">
>-        <video controls></video>
>-        <p>Test that a stalled event is sent when media loading stalls.</p>
>-    </body>
>+<head>
>+<title>'stalled' event test</title>
>+<script src="../resources/js-test-pre.js"></script>
>+<xscript src=../../media-resources/media-file.js></script>
>+<xscript src=../../media-resources/video-test.js></script>
>+<script>
>+
>+    var playCount = 0;
>+
>+    function start() 
>+    {
>+        return;
>+        alert('loaded!');
>+        findMediaElement();
>+        waitForEvent('durationchange');
>+        waitForEvent('loadedmetadata');
>+        waitForEvent('loadeddata');
>+
>+        mediaElement.addEventListener('canplay', function () {
>+            // 'stalled' takes three seconds to fire, so 'canplay' may fire more than once
>+            // depending on how the engine parses incoming media data.
>+            if (++playCount > 1)
>+                return;
>+            consoleWrite("EVENT(canplay)");
>+            run("video.play()");
>+        } );
>+
>+        waitForEvent('stalled', function () {
>+            testExpected("video.currentTime", 0, "!=");
>+            testExpected("video.playbackRate", 1, "===");
>+            testExpected("video.paused", false, "===");
>+            endTest();
>+        } );
>+
>+        var mediaFile = findMediaFile("video", "../../../../media/content/long-test");
>+        var mimeType = mimeTypeForFile(mediaFile);
>+        alert("http://127.0.0.1:8000/media/resources/serve-video.php?name=" + mediaFile + "&type=" + mimeType + "&stallOffset=100000&stallDuration=60&chunkSize=1024");
>+        video.src = "http://127.0.0.1:8000/media/resources/serve-video.php?name=" + mediaFile + "&type=" + mimeType + "&stallOffset=100000&stallDuration=60&chunkSize=1024";
>+    }
>+
>+</script>
>+</head>
>+<body onload="setTimeout(start, 0)">
>+
>+<script>
>+
>+if (window.testRunner) {
>+    testRunner.waitUntilDone();
>+    setTimeout(() => testRunner.notifyDone(), 3000);
>+}
>+
>+const source = `<!DOCTYPE html>
>+<video autoplay controls>
>+    <source src="http://127.0.0.1:8000/media/resources/serve-video.php?name=../../../../media/content/long-test.mp4&type=video/mp4&stallOffset=100000&stallDuration=60&chunkSize=1024">
>+</video>`;
>+
>+function insertFrameWithVideo() {
>+    const iframe = document.createElement('iframe');
>+    document.body.append(iframe);
>+    iframe.contentDocument.open();
>+    iframe.contentDocument.write(source);
>+    iframe.contentDocument.write(`<script>
>+        document.querySelector('video').addEventListener('stalled', () => top.deleteFrame(window.frameElement));
>+</scr` + `ipt>`);
>+    iframe.contentDocument.close();
>+}
>+
>+const maxFrameCount = 5;
>+let remainigFrameCount;
>+function addFrames() {
>+    remainigFrameCount = maxFrameCount;
>+    for (let i = 0; i < maxFrameCount; i++)
>+        insertFrameWithVideo();
>+}
>+
>+function deleteFrame(iframe) {
>+    iframe.contentDocument.open();
>+    iframe.contentDocument.write('');
>+    iframe.contentDocument.close('');
>+    setTimeout(() => iframe.remove(), 5000);
>+//    iframe.remove();
>+    remainigFrameCount--;
>+    if (!remainigFrameCount)
>+        addFrames();
>+}
>+
>+addFrames();
>+
>+/*
>+
>+function gcAndFinish() {
>+    for (let i = 0; i < 5000; i++) {
>+        document.createElement('video');
>+        document.createElement('source');
>+    }
>+    if (window.GCController)
>+        GCController.collect();
>+    if (window.GCController)
>+        GCController.collect();
>+    if (window.GCController)
>+        GCController.collect();
>+    if (window.testRunner)
>+        testRunner.notifyDone();
>+}
>+
>+function prepare() {
>+    document.querySelector('video').addEventListener('stalled', deleteVideo);
>+}
>+
>+function deleteVideo() {
>+    const iframe = document.createElement('iframe');
>+    document.body.appendChild(iframe);
>+    iframe.contentDocument.body.appendChild(this);
>+    iframe.remove();
>+    setTimeout(gcAndFinish, 0);
>+}
>+
>+prepare();*/
>+
>+</script>
>+<p>Test that a stalled event is sent when media loading stalls.</p>
>+</body>
> </html>
>Index: LayoutTests/platform/mac/TestExpectations
>===================================================================
>--- LayoutTests/platform/mac/TestExpectations	(revision 231325)
>+++ LayoutTests/platform/mac/TestExpectations	(working copy)
>@@ -1726,8 +1726,6 @@ webkit.org/b/181969 fast/events/message-
> 
> webkit.org/b/181831 [ HighSierra+ ] fast/forms/searchfield-heights.html [ Pass Failure ]
> 
>-webkit.org/b/182589 fast/dom/adopt-node-crash-2.html [ Pass Failure ]
>-
> webkit.org/b/181612 [ Debug ] webanimations/animation-opacity-animation-crash.html [ Pass Failure ]
> 
> webkit.org/b/172241 http/tests/appcache/404-resource-with-slow-main-resource.php [ Pass Failure ]

Actions: View | Formatted Diff | Diff

Attachments on bug 185238: 339393 | 339394 | 339456