Stop processing rejected promises in detached frames

...to avoid a DCHECK failure in ScriptState::Scope creation. The test is written by [email protected]. Bug: 1247801 Change-Id: Ife88bdf2e2f1bdb5016d240e859ff1a86f134cbd Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3312665 Reviewed-by: Hiroshige Hayashizaki <[email protected]> Reviewed-by: Yuki Shiino <[email protected]> Commit-Queue: Yuki Shiino <[email protected]> Auto-Submit: Yutaka Hirano <[email protected]> Cr-Commit-Position: refs/heads/main@{#947394}
web-platform-tests · Dec 2, 2021 · 507ce42 · 507ce42
1 parent a1c49ef
commit 507ce42
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 0 deletions.
diff --git a/html/semantics/scripting-1/the-script-element/promise-reject-and-remove.html b/html/semantics/scripting-1/the-script-element/promise-reject-and-remove.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+async_test(t => {
+  window.onload = t.step_func_done();
+}, 'Removing iframe in promise reject handler should not crash');
+</script>
+<iframe src="resources/promise-reject-and-remove-iframe.html"></iframe>
diff --git a/.../semantics/scripting-1/the-script-element/resources/promise-reject-and-remove-iframe.html b/.../semantics/scripting-1/the-script-element/resources/promise-reject-and-remove-iframe.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<script>
+const promise = Promise.reject();
+
+window.onload = () => {
+  promise.catch(() => parent.document.querySelector('iframe').remove());
+};
+</script>
+
+<!-- Load a slow script to delay window.onload for a while.
+     Without this, crashes are flaky. -->
+<script src="/common/slow.py"></script>