| OLD | NEW |
|---|
| 1 <html> | 1 <html> |
| 2 <head> | 2 <head> |
| 3 <script> | 3 <script> |
| 4 function openIframe() | 4 function openIframe() |
| 5 { | 5 { |
| 6 if (document.createElement && (iframe = document.createElement('iframe
'))) { | 6 if (document.createElement && (iframe = document.createElement('iframe
'))) { |
| 7 document.body.appendChild(iframe); | 7 document.body.appendChild(iframe); |
| 8 return iframe; | 8 return iframe; |
| 9 } | 9 } |
| 10 } | 10 } |
| 11 | 11 |
| 12 function runTestReplaceWholeText() | |
| 13 { | |
| 14 t1 = openIframe(); | |
| 15 var a = t1.contentWindow.frames; | |
| 16 var b = t1.contentDocument.defaultView.localStorage; | |
| 17 t1.outerText = ""; | |
| 18 t1.src = undefined; | |
| 19 first_attr = t1.attributes.item(undefined, undefined, undefined, undef
ined); | |
| 20 first_attr.firstChild.data = undefined; | |
| 21 first_attr.firstChild.DOCUMENT_FRAGMENT_NODE = a; | |
| 22 try { | |
| 23 first_attr.firstChild.DOCUMENT_FRAGMENT_NODE.localStorage.fuzz3_vi
sited="test"; | |
| 24 } catch (e) { | |
| 25 console.log("Expected exception caught."); | |
| 26 } | |
| 27 } | |
| 28 | |
| 29 function runTestOuterText() { | 12 function runTestOuterText() { |
| 30 t1 = openIframe(); | 13 t1 = openIframe(); |
| 31 var a = t1.contentWindow.frames; | 14 var a = t1.contentWindow.frames; |
| 32 var b = t1.contentDocument.defaultView.localStorage; | 15 var b = t1.contentDocument.defaultView.localStorage; |
| 33 var a_localStorage = a.localStorage; // The constructor won't be reach
able as window object property after detaching the frame. | 16 var a_localStorage = a.localStorage; // The constructor won't be reach
able as window object property after detaching the frame. |
| 34 | 17 |
| 35 t1.outerText = ""; | 18 t1.outerText = ""; |
| 36 try { | 19 try { |
| 37 a_localStorage.fuzz3_visited="test"; | 20 a_localStorage.fuzz3_visited="test"; |
| 38 } catch (e) { | 21 } catch (e) { |
| 39 console.log("Expected exception caught."); | 22 console.log("Expected exception caught."); |
| 40 } | 23 } |
| 41 } | 24 } |
| 42 | 25 |
| 43 function runTests() { | 26 function runTests() { |
| 44 runTestReplaceWholeText(); | |
| 45 runTestOuterText(); | 27 runTestOuterText(); |
| 46 document.getElementById("result").innerHTML = "passed"; | 28 document.getElementById("result").innerHTML = "passed"; |
| 47 } | 29 } |
| 48 | 30 |
| 49 if (window.testRunner) | 31 if (window.testRunner) |
| 50 testRunner.dumpAsText(); | 32 testRunner.dumpAsText(); |
| 51 | 33 |
| 52 </script> | 34 </script> |
| 53 </head> | 35 </head> |
| 54 <body onload="runTests()"> | 36 <body onload="runTests()"> |
| 55 <p>Bug: https://bugs.webkit.org/show_bug.cgi?id=57140 | 37 <p>Bug: https://bugs.webkit.org/show_bug.cgi?id=57140 |
| 56 <p>Description: Crash from null pointer dereference below WebCore::StorageAr
eaImpl::setItem() | 38 <p>Description: Crash from null pointer dereference below WebCore::StorageAr
eaImpl::setItem() |
| 57 <p>Expect: passed | 39 <p>Expect: passed |
| 58 <p>Result: <span id="result">failed</span> | 40 <p>Result: <span id="result">failed</span> |
| 59 </body> | 41 </body> |
| 60 </html> | 42 </html> |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 1158433004:
Remove Attr child nodes (making Attr a Node, not a ContainerNode) (Closed)
Base URL: svn://svn.chromium.org/blink/trunk