Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(22)

Side by Side Diff: LayoutTests/svg/custom/tref-clone-crash.html

Issue 8015009: Merge 95791 - use after free in WebCore::SVGTRefElement::updateReferencedText (Closed) Base URL: http://svn.webkit.org/repository/webkit/branches/chromium/874/
Patch Set: Created 9 years, 3 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « no previous file | LayoutTests/svg/custom/tref-clone-crash-expected.txt » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 <svg xmlns:xlink="http://www.w3.org/1999/xlink" onload="runTest()"> 1 <svg xmlns:xlink="http://www.w3.org/1999/xlink" onload="runTest()">
2 <defs> 2 <defs>
3 <style id="style"/> 3 <style id="style"/>
4 <text id="ref"></text> 4 <text id="ref"></text>
5 </defs> 5 </defs>
6 <g><use xlink:href="#ref"/></g> 6 <g><use xlink:href="#ref"/></g>
7 <g><text><tref id="tref" xlink:href="#ref"/></text></g> 7 <g><text><tref id="tref" xlink:href="#ref"/></text></g>
8 <script> 8 <script>
9 function gc() { 9 function gc() {
10 if (window.GCController) 10 if (window.GCController)
(...skipping 13 matching lines...) Expand all
24 gc(); 24 gc();
25 var elem = document.getElementById("style"); 25 var elem = document.getElementById("style");
26 var parent = elem.parentNode; 26 var parent = elem.parentNode;
27 parent.insertBefore(document.createElement("source"), elem); 27 parent.insertBefore(document.createElement("source"), elem);
28 document.body.innerHTML = "PASS"; 28 document.body.innerHTML = "PASS";
29 if (window.layoutTestController) 29 if (window.layoutTestController)
30 layoutTestController.notifyDone(); 30 layoutTestController.notifyDone();
31 } 31 }
32 </script> 32 </script>
33 </svg> 33 </svg>
OLDNEW
« no previous file with comments | « no previous file | LayoutTests/svg/custom/tref-clone-crash-expected.txt » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698