Chromium Code Reviews Chromium Code Reviews
Issue 364293004:
CANCEL: Make Range::insertNode to validate new end boundary point before using it (Closed)
Base URL: https://chromium.googlesource.com/chromium/blink.git@master| Index: LayoutTests/fast/dom/Range/surroundContents-iframe-crash.html |
| diff --git a/LayoutTests/fast/dom/Range/surroundContents-iframe-crash.html b/LayoutTests/fast/dom/Range/surroundContents-iframe-crash.html |
| new file mode 100644 |
| index 0000000000000000000000000000000000000000..359c7fcebec1717f22a496cad735a4ff3c21319d |
| --- /dev/null |
| +++ b/LayoutTests/fast/dom/Range/surroundContents-iframe-crash.html |
| @@ -0,0 +1,29 @@ |
| +<!DOCTYPE html> |
| +<html> |
| +<head> |
| +<script> |
| +if (window.testRunner) |
| + testRunner.dumpAsText(); |
| + |
| +var insSurroundContents = false; |
|
Yuta Kitamura
2014/07/04 07:11:33
"ins"?
yosin_UTC9
2014/07/04 08:45:16
Done.
|
| +onload = function() { |
| + var range = document.createRange(); |
| + range.setStart(document.body.firstChild, 2); |
| + insSurroundContents = true; |
| + var iframe = document.querySelector('iframe'); |
| + range.surroundContents(iframe); |
| + document.body.textContent = 'PASS if Blink doesn\'t crash.'; |
| +}; |
| + |
| +document.addEventListener('load', function() { |
|
Yuta Kitamura
2014/07/04 07:11:33
Defining both onload and document's "load" handler
yosin_UTC9
2014/07/04 08:45:16
Done.
|
| + if (!insSurroundContents) |
| + return; |
| + var iframe = document.querySelector('iframe'); |
| + var newText = iframe.nextSibling; |
| + newText.parentNode.removeChild(newText); |
| +}, true); |
| + |
| +</script> |
| +</head> |
| +<body>abcde<iframe></iframe></body> |
| +</html> |
