LayoutTests/fast/dom/Range/surroundContents-iframe-crash.html - Issue 364293004: CANCEL: Make Range::insertNode to validate new end boundary point before using it

Side by Side Diff

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Side by Side Diff: LayoutTests/fast/dom/Range/surroundContents-iframe-crash.html

Issue 364293004: CANCEL: Make Range::insertNode to validate new end boundary point before using it (Closed) Base URL: https://chromium.googlesource.com/chromium/blink.git@master

Patch Set: Created 6 years, 5 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch

OLD	NEW
(Empty)
	1 <!DOCTYPE html>

	2 <html>

	3 <head>

	4 <script>

	5 if (window.testRunner)

	6 testRunner.dumpAsText();

	7

	8 var insSurroundContents = false;
	Yuta Kitamura 2014/07/04 07:11:33 "ins"? "ins"? yosin_UTC9 2014/07/04 08:45:16 Done. Show quoted text On 2014/07/04 07:11:33, Yuta Kitamura wrote: > "ins"? Done.
	9 onload = function() {

	10 var range = document.createRange();

	11 range.setStart(document.body.firstChild, 2);

	12 insSurroundContents = true;

	13 var iframe = document.querySelector('iframe');

	14 range.surroundContents(iframe);

	15 document.body.textContent = 'PASS if Blink doesn\'t crash.';

	16 };

	17

	18 document.addEventListener('load', function() {
	Yuta Kitamura 2014/07/04 07:11:33 Defining both onload and document's "load" handler Defining both onload and document's "load" handler looks weird. You should use just one way of defining event handlers consistently. yosin_UTC9 2014/07/04 08:45:16 Done. Show quoted text On 2014/07/04 07:11:33, Yuta Kitamura wrote: > Defining both onload and document's "load" handler > looks weird. You should use just one way of defining > event handlers consistently. Done.
	19 if (!insSurroundContents)

	20 return;

	21 var iframe = document.querySelector('iframe');

	22 var newText = iframe.nextSibling;

	23 newText.parentNode.removeChild(newText);

	24 }, true);

	25

	26 </script>

	27 </head>

	28 <body>abcde<iframe></iframe></body>

	29 </html>

OLD	NEW

« no previous file with comments | « no previous file | LayoutTests/fast/dom/Range/surroundContents-iframe-crash-expected.txt » ('j') | Source/core/dom/Range.cpp » ('J')