Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(485)

Side by Side Diff: LayoutTests/svg/custom/tref-clone-crash.html

Issue 8041053: Revert 96034 - Merge 95791 - use after free in WebCore::SVGTRefElement::updateReferencedText (Closed) Base URL: http://svn.webkit.org/repository/webkit/branches/chromium/835/
Patch Set: Created 9 years, 2 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « no previous file | LayoutTests/svg/custom/tref-clone-crash-expected.txt » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
(Empty)
1 <svg xmlns:xlink="http://www.w3.org/1999/xlink" onload="runTest()">
2 <defs>
3 <style id="style"/>
4 <text id="ref"></text>
5 </defs>
6 <g><use xlink:href="#ref"/></g>
7 <g><text><tref id="tref" xlink:href="#ref"/></text></g>
8 <script>
9 function gc() {
10 if (window.GCController)
11 GCController.collect();
12 else {
13 for (var i = 0; i < 10000; ++i)
14 new Object;
15 }
16 }
17 if (window.layoutTestController) {
18 layoutTestController.dumpAsText();
19 layoutTestController.waitUntilDone();
20 }
21 function runTest() {
22 var tref = document.getElementById("tref");
23 tref.cloneNode(true);
24 gc();
25 var elem = document.getElementById("style");
26 var parent = elem.parentNode;
27 parent.insertBefore(document.createElement("source"), elem);
28 document.body.innerHTML = "PASS";
29 if (window.layoutTestController)
30 layoutTestController.notifyDone();
31 }
32 </script>
33 </svg>
OLDNEW
« no previous file with comments | « no previous file | LayoutTests/svg/custom/tref-clone-crash-expected.txt » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698