Chromium Code Reviews Chromium Code Reviews
Issue 198783006:
Hold SVGFontFaceElement in SVGDocumentExtensions until StyleRecalc is finished (Closed)
Base URL: svn://svn.chromium.org/blink/trunk| Index: LayoutTests/fast/dom/remove-svg-font-face-element-crash.xhtml |
| diff --git a/LayoutTests/fast/dom/remove-svg-font-face-element-crash.xhtml b/LayoutTests/fast/dom/remove-svg-font-face-element-crash.xhtml |
| new file mode 100644 |
| index 0000000000000000000000000000000000000000..92f5b26e1671f1b46e0d8c78a115c08d01a70cf3 |
| --- /dev/null |
| +++ b/LayoutTests/fast/dom/remove-svg-font-face-element-crash.xhtml |
| @@ -0,0 +1,46 @@ |
| +<html xmlns="http://www.w3.org/1999/xhtml" xlink="http://www.w3.org/1999/xlink"> |
| +<body> |
| + <svg version="1.1" xlink="http://www.w3.org/1999/xlink" width="100%" xmlns="http://www.w3.org/2000/svg"> |
| + <g> |
| + <defs> |
|
kouhei (in TOK)
2014/03/17 09:39:27
Nit: indent consistently?
tasak
2014/03/18 10:43:26
Done.
|
| + <font horiz-adv-x="224" id="embeded"> |
| + <font-face font-family="embeded" id="fontWillBeRemoved"></font-face> |
| + <glyph horiz-adv-x="1500" unicode="1"></glyph> |
| + <glyph horiz-adv-x="1500" unicode="2"></glyph> |
| + <glyph horiz-adv-x="1500" unicode="3"></glyph> |
| + <glyph horiz-adv-x="1500" unicode="4"></glyph> |
| + <glyph horiz-adv-x="1500" unicode="fi"></glyph> |
| + </font> |
| + </defs> |
| + <g> |
| + <use id="use"></use> |
| + <text font-family="embeded" id="text">fi1234</text> |
| + </g> |
| + </g> |
| +</svg> |
| +</body> |
| +<script> |
| +// crbug.com/352178: Heap-use-after-free in WebCore::SVGFontFaceElement::associatedFontElement. |
| +// PASS if no crash occurs. |
| +if (window.testRunner) |
| + window.testRunner.dumpAsText(); |
| + |
| +document.execCommand("SelectAll"); |
| + |
| +function runTest() { |
| + setTimeout(function() { |
| + var fontWillBeRemoved = document.getElementById("fontWillBeRemoved"); |
| + var use = document.getElementById("use"); |
| + var text = document.getElementById("text"); |
| + |
| + fontWillBeRemoved.parentNode.removeChild(fontWillBeRemoved); |
| + delete fontWillBeRemoved; |
| + fontWillBeRemoved = null; |
| + use.appendChild(text); |
| + }, 0); |
| +} |
| + |
| +document.addEventListener("DOMContentLoaded", runTest, false); |
| +</script> |
| +</html> |
| + |
