LayoutTests/fast/dom/remove-svg-font-face-element-crash.xhtml - Issue 198783006: Hold SVGFontFaceElement in SVGDocumentExtensions until StyleRecalc is finished

Side by Side Diff

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Side by Side Diff: LayoutTests/fast/dom/remove-svg-font-face-element-crash.xhtml

Issue 198783006: Hold SVGFontFaceElement in SVGDocumentExtensions until StyleRecalc is finished (Closed) Base URL: svn://svn.chromium.org/blink/trunk

Patch Set: Fixed indent Created 6 years, 9 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch | Annotate | Revision Log

OLD	NEW
(Empty)
	1 <html xmlns="http://www.w3.org/1999/xhtml" xlink="http://www.w3.org/1999/xlink">

	2 <body>

	3 <svg version="1.1" xlink="http://www.w3.org/1999/xlink" width="100%" xmlns="http ://www.w3.org/2000/svg">

	4 <g>

	5 <defs>

	6 <font horiz-adv-x="224" id="embeded">

	7 <font-face font-family="embeded" id="fontWillBeRemoved"></font-f ace>

	8 <glyph horiz-adv-x="1500" unicode="1"></glyph>

	9 <glyph horiz-adv-x="1500" unicode="2"></glyph>

	10 <glyph horiz-adv-x="1500" unicode="3"></glyph>

	11 <glyph horiz-adv-x="1500" unicode="4"></glyph>

	12 <glyph horiz-adv-x="1500" unicode="fi"></glyph>

	13 </font>

	14 </defs>

	15 <g>

	16 <use id="use"></use>

	17 <text font-family="embeded" id="text">fi1234</text>

	18 </g>

	19 </g>

	20 </svg>

	21 </body>

	22 <script>

	23 // crbug.com/352178: Heap-use-after-free in WebCore::SVGFontFaceElement::associa tedFontElement.

	24 // PASS if no crash occurs.

	25 if (window.testRunner)

	26 window.testRunner.dumpAsText();

	27

	28 document.execCommand("SelectAll");

	29

	30 function runTest() {

	31 setTimeout(function() {

	32 var fontWillBeRemoved = document.getElementById("fontWillBeRemoved");

	33 var use = document.getElementById("use");

	34 var text = document.getElementById("text");

	35

	36 fontWillBeRemoved.parentNode.removeChild(fontWillBeRemoved);

	37 delete fontWillBeRemoved;

	38 fontWillBeRemoved = null;

	39 use.appendChild(text);

	40 }, 0);

	41 }

	42

	43 document.addEventListener("DOMContentLoaded", runTest, false);

	44 </script>

	45 </html>

	46

OLD	NEW

« no previous file with comments | « no previous file | LayoutTests/fast/dom/remove-svg-font-face-element-crash-expected.txt » ('j') | no next file with comments »