LayoutTests/fast/table/table-rowspan-crash-with-huge-rowspan-cells-2.html - Issue 23874023: Heap-buffer-overflow in void std::__final_insertion_sort.

Side by Side Diff

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Side by Side Diff: LayoutTests/fast/table/table-rowspan-crash-with-huge-rowspan-cells-2.html

Issue 23874023: Heap-buffer-overflow in void std::__final_insertion_sort. (Closed) Base URL: https://chromium.googlesource.com/chromium/blink.git@master

Patch Set: Created 7 years, 2 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch

OLD	NEW
(Empty)
	1 <!DOCTYPE html>

	2 <html>

	3 <script type="text/javascript"> if (window.testRunner) testRunner.dumpAsText(); </script>
	Julien - ping for review 2013/09/24 21:18:09 Let's indent that like our code and remove the unn Let's indent that like our code and remove the unneeded 'type' attribute: <script> if (window.testRunner) testRunner.dumpAsText(); </script> a.suchit 2013/09/25 06:12:48 Done. Show quoted text On 2013/09/24 21:18:09, Julien Chaffraix wrote: > Let's indent that like our code and remove the unneeded 'type' attribute: > > <script> > if (window.testRunner) > testRunner.dumpAsText(); > </script> Done.
	4 <body>

	5 <h3>Test for chromium bug : <a href="https://code.google.com/p/chromium/issues/d etail?id=296003">296003</a>. Heap-buffer-overflow in void std::__final_insertion _sort.</h3>

	6 <h4>It should not crash.</h4>
	Julien - ping for review 2013/09/24 21:18:09 For this test to PASS, it should not crash. (witho For this test to PASS, it should not crash. (without the first half, it's not totally obvious what is expected) a.suchit 2013/09/25 06:12:48 Done. Show quoted text On 2013/09/24 21:18:09, Julien Chaffraix wrote: > For this test to PASS, it should not crash. (without the first half, it's not > totally obvious what is expected) Done.
	7 <table>

	8 <td rowspan=3>><td rowspan=3>><td rowspan=6>><td rowspan=4</td>
	Julien - ping for review 2013/09/24 21:18:09 Could we change the content '>' into a more explic Could we change the content '>' into a more explicit content like row1column1 (rowspan=3), ... Also let's indent this properly, and properly close the tags so that we don't rely on the closing behavior from the parser. a.suchit 2013/09/25 06:12:48 Done. Show quoted text On 2013/09/24 21:18:09, Julien Chaffraix wrote: > Could we change the content '>' into a more explicit content like row1column1 > (rowspan=3), ... > > Also let's indent this properly, and properly close the tags so that we don't > rely on the closing behavior from the parser. Done.
	9 <td rowspan=16><td rowspan=4><td rowspan=12><td rowspan=4><td rowspan=12><tr>> <tr>

	10 <td rowspan=3><td rowspan=8><td rowspan=8><td rowspan=8><td rowspan=8></tr>

	11 <td><tr>

	12 <td rowspan=4><td rowspan=370><tr><tr>><tr><td rowspan=6><td rowspan=6>>></tr>

	13 <td rowspan=4><td rowspan=12><td rowspan=16><td rowspan=179><td rowspan=33</tr >

	14 <tr>

	15 <td rowspan=35><td rowspan=3><td rowspan=6><td rowspan=24><td rowspan=19><td row span=3><td rowspan=13><td rowspan=22>><td rowspan=5><td rowspan=20>

	16 </body>

	17 </html>

OLD	NEW

« no previous file with comments | « no previous file | LayoutTests/fast/table/table-rowspan-crash-with-huge-rowspan-cells-2-expected.txt » ('j') | no next file with comments »