Chromium Code Reviews Chromium Code Reviews
Issue 1265573003:
Fix crash on null ptr dereference in EventPath propagation (Closed)
Base URL: svn://svn.chromium.org/blink/trunk| Index: LayoutTests/fast/events/event-fire-disconnected-shadow-dom-crash.html |
| diff --git a/LayoutTests/fast/events/event-fire-disconnected-shadow-dom-crash.html b/LayoutTests/fast/events/event-fire-disconnected-shadow-dom-crash.html |
| new file mode 100644 |
| index 0000000000000000000000000000000000000000..7cb09ced66899de7097b251b4d959cfd4d02a2a7 |
| --- /dev/null |
| +++ b/LayoutTests/fast/events/event-fire-disconnected-shadow-dom-crash.html |
| @@ -0,0 +1,30 @@ |
| +<!DOCTYPE html> |
|
hayato
2015/08/03 05:49:24
Could we minimize this test further?
I can't read
|
| +<script src="../../resources/js-test.js"></script> |
| + |
| +<div id="root"> |
| +<span id="div1"></span> |
| +</div> |
| + |
| +<!-- This is a minified version of the clusterfuzz test case at https://code.google.com/p/chromium/issues/detail?id=507413 --> |
| +<script> |
| + |
| +description("Generated by cluster-fuzz. This test passes if it doesn't crash."); |
| + |
| +document.addEventListener("selectstart", function() { |
| + var oElement = event.srcElement; |
| + oElement.innerHTML = "<option>A<a>B<option>C</option></a></option>"; |
| + function scopedCall(aElement) { |
| + aElement.innerHTML = "ABCD"; |
| + }(oElement); |
| +} |
| +); |
| + |
| +document.addEventListener("DOMNodeInserted", function() { |
| + var oElement = event.srcElement; |
| + oElement.innerHTML = "ABC"; |
| + oElement = document.importNode(oElement, true) |
| +}); |
| + |
| +document.execCommand("SelectAll") |
| + |
| +</script> |
