LayoutTests/editing/undo/undo-after-event-edited.html - Issue 14829006: Use after free in WebCore::dispatchEditableContentChangedEvents

Side by Side Diff: LayoutTests/editing/undo/undo-after-event-edited.html

Issue 14829006: Use after free in WebCore::dispatchEditableContentChangedEvents (Closed) Base URL: https://chromium.googlesource.com/chromium/blink.git@master

Patch Set: add test for dispatchEvent UAF Created 7 years, 7 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch

OLD	NEW
(Empty)
	1 <head>
	inferno 2013/05/14 18:00:00 Please add <!DOCTYPE html> and <html> opening, clo Please add <!DOCTYPE html> and <html> opening, closing tag. Will Harris 2013/05/14 22:25:54 Done. Show quoted text On 2013/05/14 18:00:00, inferno wrote: > Please add <!DOCTYPE html> and <html> opening, closing tag. Done.
	2 <style>

	3 * {display:run-in;}
	inferno 2013/05/14 18:00:00 spaces around { } spaces around { } Will Harris 2013/05/14 22:25:54 Done. Show quoted text On 2013/05/14 18:00:00, inferno wrote: > spaces around { } Done.
	4 .collapse {visibility:collapse;}

	5 </style>

	6 <script>

	7 // BUG=237429
	inferno 2013/05/14 18:00:00 No need of bug number here. No need of bug number here. Will Harris 2013/05/14 22:25:54 Done. Show quoted text On 2013/05/14 18:00:00, inferno wrote: > No need of bug number here. Done.
	8

	9 if (window.testRunner) {

	10 window.testRunner.dumpAsText();

	11 window.testRunner.waitUntilDone();

	12 }

	13

	14 document.designMode = "on";

	15 var aoScriptElements = document.getElementsByTagName("script");
	inferno 2013/05/14 18:00:00 s/aoScriptElements/scriptElements s/aoScriptElements/scriptElements Will Harris 2013/05/14 22:25:54 Done. Show quoted text On 2013/05/14 18:00:00, inferno wrote: > s/aoScriptElements/scriptElements Done.
	16 aoScriptElements[0].parentNode.removeChild(aoScriptElements[0]);

	17 var event_handler_webkitEditableContentChanged_active = false;
	inferno 2013/05/14 18:00:00 s/event_handler_webkitEditableContentChanged_activ s/event_handler_webkitEditableContentChanged_active/eventHandleEnabled Will Harris 2013/05/14 22:25:54 Done. Show quoted text On 2013/05/14 18:00:00, inferno wrote: > s/event_handler_webkitEditableContentChanged_active/eventHandleEnabled Done.
	18

	19 function event_handler_webkitEditableContentChanged() {

	20 if (event_handler_webkitEditableContentChanged_active) return ;
	inferno 2013/05/14 18:00:00 return on new line and indented. return on new line and indented. Will Harris 2013/05/14 22:25:54 Done. Show quoted text On 2013/05/14 18:00:00, inferno wrote: > return on new line and indented. Done.
	21 event_handler_webkitEditableContentChanged_active = true;

	22 var oElement = event.srcElement;
	inferno 2013/05/14 18:00:00 s/oElement/srcElement s/oElement/srcElement Will Harris 2013/05/14 22:25:54 Done. Show quoted text On 2013/05/14 18:00:00, inferno wrote: > s/oElement/srcElement Done.
	23 document.execCommand('InsertText',false,'FAIL1');

	24 try{oElement.textContent = "PASS"}
	inferno 2013/05/14 18:00:00 is try, catch required. if yes, please indent and is try, catch required. if yes, please indent and put on like try { statement; } catch(e) { } inferno 2013/05/14 18:00:00 s/PASS/Pass. Test didn't crash. s/PASS/Pass. Test didn't crash. Will Harris 2013/05/14 22:25:54 removed exception handler, it never gets used in t removed exception handler, it never gets used in the test
	25 catch(e){}

	26 event_handler_webkitEditableContentChanged_active = false;

	27 if (window.testRunner)

	28 window.testRunner.notifyDone();

	29 }

	30 document.addEventListener("webkitEditableContentChanged", event_handler_webkitEd itableContentChanged, true);

	31 function event_handler_DOMCharacterDataModified() {
	inferno 2013/05/14 18:00:00 new lines before and after function declaration. new lines before and after function declaration. Will Harris 2013/05/14 22:25:54 Done. Show quoted text On 2013/05/14 18:00:00, inferno wrote: > new lines before and after function declaration. Done.
	32 document.execCommand('InsertParagraph',false,false);

	33 }

	34 document.addEventListener("DOMCharacterDataModified", event_handler_DOMCharacter DataModified, false);

	35 setTimeout(function(){
	inferno 2013/05/14 18:00:00 space before { space before { Will Harris 2013/05/14 22:25:54 Done. Show quoted text On 2013/05/14 18:00:00, inferno wrote: > space before { Done.
	36 var oSelection=window.getSelection();
	inferno 2013/05/14 18:00:00 s/oSelection/selection s/oSelection/selection Will Harris 2013/05/14 22:25:54 Done. Show quoted text On 2013/05/14 18:00:00, inferno wrote: > s/oSelection/selection Done.
	37 if (!oSelection.rangeCount) {
	inferno 2013/05/14 18:00:00 no need of braces for single line statmenents. no need of braces for single line statmenents. Will Harris 2013/05/14 22:25:54 Done. Show quoted text On 2013/05/14 18:00:00, inferno wrote: > no need of braces for single line statmenents. Done.
	38 document.execCommand("SelectAll", false)

	39 }

	40 var oRange = oSelection.rangeCount ? oSelection.getRangeAt(2 % oSelection.rang eCount) : null;
	inferno 2013/05/14 18:00:00 s/2 % oSelection.rangeCount/ can you hardcode this s/2 % oSelection.rangeCount/ can you hardcode this value, you can do an alert to see what needs to com ehere. Will Harris 2013/05/14 22:25:54 Done. Show quoted text On 2013/05/14 18:00:00, inferno wrote: > s/2 % oSelection.rangeCount/ can you hardcode this value, you can do an alert to > see what needs to com ehere. Done.
	41 if (oRange) {

	42 try{var oDocumentFragment = oRange.extractContents()}
	inferno 2013/05/14 18:00:00 is try, catch required here. is try, catch required here. Will Harris 2013/05/14 22:25:54 removed exception handler, it never gets used in t removed exception handler, it never gets used in the test
	43 catch(e){}

	44 }

	45 document.execCommand('Undo',false);

	46 }, 1);

	47
	inferno 2013/05/14 18:00:00 no need of new line. no need of new line. Will Harris 2013/05/14 22:25:54 Done. Show quoted text On 2013/05/14 18:00:00, inferno wrote: > no need of new line. Done.
	48 </script>

	49 </head>

	50 <body>

	51 <table class="collapse">

	52 <caption>

	53 FAIL0
	inferno 2013/05/14 18:00:00 FAIL0, FAIL1 make no sense here. Since this a cras FAIL0, FAIL1 make no sense here. Since this a crasher test, we can just have regular string like ABCD, etc. Will Harris 2013/05/14 22:25:54 Done. Show quoted text On 2013/05/14 18:00:00, inferno wrote: > FAIL0, FAIL1 make no sense here. Since this a crasher test, we can just have > regular string like ABCD, etc. Done.
	54 </caption>

	55 </table>

	56 </body>

	57

OLD	NEW

« no previous file with comments | « no previous file | LayoutTests/editing/undo/undo-after-event-edited-expected.txt » ('j') | no next file with comments »