Chromium Code Reviews Chromium Code Reviews
Issue 203483002:
Clear sibling floats while splitting inline flow. (Closed)
Base URL: https://chromium.googlesource.com/chromium/blink.git@master| Index: LayoutTests/fast/block/float/split-inline-sibling-of-float-crash.html |
| diff --git a/LayoutTests/fast/block/float/split-inline-sibling-of-float-crash.html b/LayoutTests/fast/block/float/split-inline-sibling-of-float-crash.html |
| new file mode 100644 |
| index 0000000000000000000000000000000000000000..4eb7004ee55a28efefecdb901c2109c387a18f1f |
| --- /dev/null |
| +++ b/LayoutTests/fast/block/float/split-inline-sibling-of-float-crash.html |
| @@ -0,0 +1,32 @@ |
| +<html> |
| +<p style='white: fuchsia; padding: 198px 108 2147483647px; '></p> |
| +<myelement> |
| +<body> |
| + <sup style="kerning: 7; display: table-row; "></sup> |
| + <iframe align=right style="font-variant: small-caps;> mask: url(#tCF84); border-right-width: 20543.4114163cm; "></iframe> |
| + <p id=tCF100></p> |
| + <span id=tCF104> |
| +</body> |
| +<script> |
| +window.onload = function() { |
| + keygenElem = document.createElementNS("http://www.w3.org/1999/xhtml", "keygen"); |
| + keygenElem.setAttribute("autofocus", "Tm"); |
| + document.body.appendChild(keygenElem); |
| + document.body.appendChild(document.createElementNS("http://www.w3.org/1999/xhtml", "td")); |
| + document.body.appendChild(document.createElementNS("http://www.w3.org/1999/xhtml", "video")); |
| + setTimeout("CFcrash()", 1); |
|
aarya
2014/03/18 17:45:44
Is this timeout really required ? can you try with
kenrb
2014/03/18 18:00:21
I tried that, but the UAF no longer reproduced, an
|
| + |
| + if (window.testRunner) |
| + testRunner.waitUntilDone(); |
| +} |
| +function CFcrash() { |
| + tCF104.appendChild(tCF100); |
| + document.body.innerHTML = "PASS if no crash or assert under ASAN"; |
| + |
| + if (window.testRunner) { |
| + testRunner.dumpAsText(); |
| + testRunner.notifyDone(); |
| + } |
| +} |
| +</script> |
| +</html> |
