LayoutTests/fast/table/table-rowspan-crash-with-huge-rowspan-cells-2.html - Issue 23874023: Heap-buffer-overflow in void std::__final_insertion_sort.

Unified Diff: LayoutTests/fast/table/table-rowspan-crash-with-huge-rowspan-cells-2.html

Issue 23874023: Heap-buffer-overflow in void std::__final_insertion_sort. (Closed) Base URL: https://chromium.googlesource.com/chromium/blink.git@master

Patch Set: Created 7 years, 3 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View side-by-side diff with in-line comments

Download patch

Index: LayoutTests/fast/table/table-rowspan-crash-with-huge-rowspan-cells-2.html

diff --git a/LayoutTests/fast/table/table-rowspan-crash-with-huge-rowspan-cells-2.html b/LayoutTests/fast/table/table-rowspan-crash-with-huge-rowspan-cells-2.html

new file mode 100644

index 0000000000000000000000000000000000000000..7edf125eea349ebb4f06e6e8d516470fba213a70

--- /dev/null

+++ b/LayoutTests/fast/table/table-rowspan-crash-with-huge-rowspan-cells-2.html

@@ -0,0 +1,17 @@

+<!DOCTYPE html>

+<html>

+<script type="text/javascript"> if (window.testRunner) testRunner.dumpAsText(); </script>

Julien - ping for review 2013/09/24 21:18:09 Let's indent that like our code and remove the unn

a.suchit 2013/09/25 06:12:48 Done.

+<body>

+<h3>Test for chromium bug : <a href="https://code.google.com/p/chromium/issues/detail?id=296003">296003</a>. Heap-buffer-overflow in void std::__final_insertion_sort.</h3>

+<h4>It should not crash.</h4>

Julien - ping for review 2013/09/24 21:18:09 For this test to PASS, it should not crash. (witho

a.suchit 2013/09/25 06:12:48 Done.

+<table>

+<td rowspan=3>><td rowspan=3>><td rowspan=6>><td rowspan=4</td>

Julien - ping for review 2013/09/24 21:18:09 Could we change the content '>' into a more explic

a.suchit 2013/09/25 06:12:48 Done.

+ <td rowspan=16><td rowspan=4><td rowspan=12><td rowspan=4><td rowspan=12><tr>><tr>

+ <td rowspan=3><td rowspan=8><td rowspan=8><td rowspan=8><td rowspan=8></tr>

+<td><tr>

+ <td rowspan=4><td rowspan=370><tr><tr>><tr><td rowspan=6><td rowspan=6>>></tr>

+ <td rowspan=4><td rowspan=12><td rowspan=16><td rowspan=179><td rowspan=33</tr>

+<tr>

+<td rowspan=35><td rowspan=3><td rowspan=6><td rowspan=24><td rowspan=19><td rowspan=3><td rowspan=13><td rowspan=22>><td rowspan=5><td rowspan=20>

+</body>

+</html>

« no previous file with comments | « no previous file | LayoutTests/fast/table/table-rowspan-crash-with-huge-rowspan-cells-2-expected.txt » ('j') | no next file with comments »