| OLD | NEW |
|---|
| (Empty) | |
| 1 <!DOCTYPE html> |
| 2 <html> |
| 3 <script type="text/javascript"> |
| 4 if (window.testRunner) |
| 5 testRunner.dumpAsText(); |
| 6 </script> |
| 7 <body> |
| 8 <h3>Test for chromium bug : <a href="https://code.google.com/p/chromium/issues/d
etail?id=296003">296003</a>. Heap-buffer-overflow in void std::__final_insertion
_sort.</h3> |
| 9 <h4>For this test to PASS, it should not crash.</h4> |
| 10 <table border="1"> |
| 11 <tr> |
| 12 <td rowspan=3>row0col0 (rowspan=3)</td> |
| 13 <td rowspan=3>row0col1 (rowspan=3)</td> |
| 14 <td rowspan=6>row0col2 (rowspan=6)</td> |
| 15 <td rowspan=4>row0col3 (rowspan=4)</td> |
| 16 <td rowspan=16>row0col4 (rowspan=16)</td> |
| 17 <td rowspan=4>row0col5 (rowspan=4)</td> |
| 18 <td rowspan=12>row0col6 (rowspan=12)</td> |
| 19 <td rowspan=4>row0col7 (rowspan=4)</td> |
| 20 <td rowspan=12>row0col8 (rowspan=12)</td> |
| 21 </tr> |
| 22 <tr> |
| 23 <td>row1col9</td> |
| 24 </tr> |
| 25 <tr> |
| 26 <td rowspan=3>row2col9 (rowspan=3)</td> |
| 27 <td rowspan=8>row2col10 (rowspan=8)</td> |
| 28 <td rowspan=8>row2col11 (rowspan=8)</td> |
| 29 <td rowspan=8>row2col12 (rowspan=8)</td> |
| 30 <td rowspan=8>row2col13 (rowspan=8)</td> |
| 31 </tr> |
| 32 <tr> |
| 33 <td>row3col0</td> |
| 34 </tr> |
| 35 <tr> |
| 36 <td rowspan=4>row4col0 (rowspan=4)</td> |
| 37 <td rowspan=370>row4col1 (rowspan=370)</td> |
| 38 </tr> |
| 39 <tr> |
| 40 <td>row5col3</td> |
| 41 </tr> |
| 42 <tr> |
| 43 <td>row6col2</td> |
| 44 </tr> |
| 45 <tr> |
| 46 <td rowspan=6>row7col2 (rowspan=6)</td> |
| 47 <td rowspan=6>row7col3 (rowspan=6)</td> |
| 48 </tr> |
| 49 <tr> |
| 50 <td rowspan=4>row8col0 (rowspan=4)</td> |
| 51 <td rowspan=12>row8col5 (rowspan=12)</td> |
| 52 <td rowspan=16>row8col7 (rowspan=16)</td> |
| 53 <td rowspan=179>row8col9 (rowspan=179)</td> |
| 54 <td rowspan=33>row8col14 (rowspan=33)</td> |
| 55 </tr> |
| 56 <tr> |
| 57 <td rowspan=35>row9col15 (rowspan=35)</td> |
| 58 <td rowspan=3>row9col16 (rowspan=3)</td> |
| 59 <td rowspan=6>row9col17 (rowspan=6)</td> |
| 60 <td rowspan=24>row9col18 (rowspan=24)</td> |
| 61 <td rowspan=19>row9col19 (rowspan=19)</td> |
| 62 <td rowspan=3>row9col20 (rowspan=3)</td> |
| 63 <td rowspan=13>row9col21 (rowspan=13)</td> |
| 64 <td rowspan=22>row9col22 (rowspan=22)</td> |
| 65 <td rowspan=5>row9col23 (rowspan=5)</td> |
| 66 <td rowspan=20>row9col24 (rowspan=20)</td> |
| 67 </tr> |
| 68 </table> |
| 69 </body> |
| 70 </html> |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 23874023:
Heap-buffer-overflow in void std::__final_insertion_sort. (Closed)
Base URL: https://chromium.googlesource.com/chromium/blink.git@master