PointerEvents: followup events fired to nodes in deleted iframes |
||||||
Issue descriptionWe need to be careful before firing followup MouseEvent/TouchEvent for a PointerEvent. In this repro, Chrome crashes when an iframe is removed on "pointerdown". Steps to repro: 0. Open Chrome with PointerEvents enabled. 1. Goto https://output.jsbin.com/sonohi 2. Click or tap on green center-box, to remove the box. 3. Click or tap on pink center-box, to remove the frame. Expected outcome: Chrome shouldn't crash. Actual outcome: Chrome crashes after Step 3 in Windows. Not sure why Chrome behaves differently in Windows here. In Linux/CrOS, couldn't repro the crash.
,
May 6 2016
Might depend on GC timing which is unpredictable. You can probably trigger it in a test by forcing a GC (look at the other similar crash tests in fast/events).
,
Jun 29 2016
Adding "PointerEvent" label to bugs that doesn't really block enabling behind experimental flag.
,
Jun 29 2017
This issue has been Available for over a year. If it's no longer important or seems unlikely to be fixed, please consider closing it out. If it is important, please re-triage the issue. Sorry for the inconvenience if the bug really should have been left as Available. If you change it back, also remove the "Hotlist-Recharge-Cold" label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Jun 29 2017
Mustaq, could you re-triage this please?
,
Jun 29 2017
Assigning to Navid since he looked at the blocker bug. If you don't find time to look into it, feel free to assign to me.
,
Dec 27
mustaq@ I don't think the crash exists anymore. Maybe the blocker bug resolved it already? Can we close it now then?
,
Jan 2
|
||||||
►
Sign in to add a comment |
||||||
Comment 1 by mustaq@chromium.org
, May 6 2016