LayoutTests/fast/events/event-fire-disconnected-shadow-dom-crash.html - Issue 1265573003: Fix crash on null ptr dereference in EventPath propagation

Side by Side Diff

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Side by Side Diff: LayoutTests/fast/events/event-fire-disconnected-shadow-dom-crash.html

Issue 1265573003: Fix crash on null ptr dereference in EventPath propagation (Closed) Base URL: svn://svn.chromium.org/blink/trunk

Patch Set: add another comment Created 5 years, 4 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch | Annotate | Revision Log

OLD	NEW
(Empty)
	1 <!DOCTYPE html>
	hayato 2015/08/03 05:49:24 Could we minimize this test further? I can't read Could we minimize this test further? I can't read why we need <option> twice and why we need scopedCall() to reproduce a crash. It would be helpful to leave your thought about this HTML. It it's difficult to know what would happen in background, it might be useful to record that which shadow host was removed and whose shadow root's host would be null in this test. Couldn't we reproduce a crash by dispatching a synthetic event? From the description, this sounds possible. Removing a shadow host and dispatching an event on shadow root, by keeping a reference to the shadow host, aren't enough?
	2 <script src="../../resources/js-test.js"></script>

	3

	4 <div id="root">

	5 <span id="div1"></span>

	6 </div>

	7

	8 <!-- This is a minified version of the clusterfuzz test case at https://code.goo gle.com/p/chromium/issues/detail?id=507413 -->

	9 <script>

	10

	11 description("Generated by cluster-fuzz. This test passes if it doesn't crash.");

	12

	13 document.addEventListener("selectstart", function() {

	14 var oElement = event.srcElement;

	15 oElement.innerHTML = "<option>A<a>B<option>C</option></a></option>";

	16 function scopedCall(aElement) {

	17 aElement.innerHTML = "ABCD";

	18 }(oElement);

	19 }

	20 );

	21

	22 document.addEventListener("DOMNodeInserted", function() {

	23 var oElement = event.srcElement;

	24 oElement.innerHTML = "ABC";

	25 oElement = document.importNode(oElement, true)

	26 });

	27

	28 document.execCommand("SelectAll")

	29

	30 </script>

OLD	NEW

« no previous file with comments | « no previous file | LayoutTests/fast/events/event-fire-disconnected-shadow-dom-crash-expected.txt » ('j') | no next file with comments »