| Index: third_party/WebKit/LayoutTests/fast/dom/HTMLMenuItemElement/menuitem-crash-asan.html
|
| diff --git a/third_party/WebKit/LayoutTests/fast/dom/HTMLMenuItemElement/menuitem-crash-asan.html b/third_party/WebKit/LayoutTests/fast/dom/HTMLMenuItemElement/menuitem-crash-asan.html
|
| new file mode 100644
|
| index 0000000000000000000000000000000000000000..b46dab9dd7ae44a0bf8dbdb009a1439ffe116af3
|
| --- /dev/null
|
| +++ b/third_party/WebKit/LayoutTests/fast/dom/HTMLMenuItemElement/menuitem-crash-asan.html
|
| @@ -0,0 +1,26 @@
|
| +<!DOCTYPE html>
|
| +<html>
|
| +<body>
|
| +Test passes if it does not crash on Linux ASan builds.
|
| +<menuitem id="domfuzz" checked type="radio"><menuitem checked>
|
| +<script>
|
| +function fuzz() {
|
| + document.getElementById("domfuzz").addEventListener(
|
| + "fullscreenerror", function() {
|
| + var elt = document.getElementById("domfuzz");
|
| + elt.setAttribute("radiogroup", "G1");
|
| + });
|
| + e = document.createEvent("Event");
|
| + var element = document.getElementById("domfuzz");
|
| + e.initEvent("fullscreenerror");
|
| + element.dispatchEvent(e);
|
| + e = document.createEvent("Event");
|
| + e.initEvent("click");
|
| + element.dispatchEvent(e);
|
| +}
|
| +if (window.testRunner) {
|
| + testRunner.dumpAsText();
|
| + fuzz();
|
| +}
|
| +</script>
|
| +</body>
|
|
|
Chromium Code Reviews
Issue 1962073003:
Fix ASan container overflow in HTMLMenuItemElement::defaultEventHandler (Closed)
Base URL: https://chromium.googlesource.com/chromium/src.git@master