Chromium Code Reviews Chromium Code Reviews
Issue 188693007:
Added checks for integer overflow conditions to deleteData and replaceData.
Base URL: https://chromium.googlesource.com/chromium/blink.git@master| Index: LayoutTests/fast/dom/Range/deleteData-replaceData-count-overflow.html |
| diff --git a/LayoutTests/fast/dom/Range/deleteData-replaceData-count-overflow.html b/LayoutTests/fast/dom/Range/deleteData-replaceData-count-overflow.html |
| new file mode 100644 |
| index 0000000000000000000000000000000000000000..0182068f6d0fe187a1667f93840a2d2e59b9ad36 |
| --- /dev/null |
| +++ b/LayoutTests/fast/dom/Range/deleteData-replaceData-count-overflow.html |
| @@ -0,0 +1,39 @@ |
| +<!DOCTYPE html> |
| +<html> |
| +<body> |
| +<p>This test checks to make sure that deleteData does not overflow with a large 'count' parameter</p> |
| +<div id="result1">FAIL</div> |
| +<div id="result2">FAIL</div> |
| +<script type="text/javascript"> |
| +var a = new Text("aaaaaaaaaa"); |
| +document.body.appendChild(a); |
| + |
| +document.getSelection().extend(a, 10); |
| +range = document.getSelection().getRangeAt(0); |
| + |
| +try { |
| + a.deleteData(9, 0xfffffff7); |
| +} catch(ex) { |
| + document.getElementById("result1").innerText = "deleteData - PASS"; |
| +} |
| + |
| +window.getSelection().removeAllRanges(); |
| + |
| +var b = new Text("bbbbbbbbbb"); |
| +document.body.appendChild(b); |
| + |
| +document.getSelection().extend(b, 10); |
| +range = document.getSelection().getRangeAt(0); |
| + |
| +try { |
|
Inactive
2014/03/17 00:04:33
It would also be nice if this test used js-test.js
|
| + b.replaceData(9, 0xfffffff7); |
| +} catch(ex) { |
| + document.getElementById("result2").innerText = "replaceData - PASS"; |
| +} |
| + |
| +if (window.testRunner) { |
| + window.testRunner.dumpAsText(); |
| +} |
| +</script> |
| +</body> |
| +</html> |
