Title: [243235] trunk/LayoutTests
- Revision
- 243235
- Author
- [email protected]
- Date
- 2019-03-20 13:35:25 -0700 (Wed, 20 Mar 2019)
Log Message
REGRESSION(r240634): Element::hasPointerCapture() passes a JS-controlled value directly into a HashMap as a key
https://bugs.webkit.org/show_bug.cgi?id=195683
Reviewed by Alex Christensen.
Adding the test that was supposed to have landed along with r242893.
* pointerevents/pointer-id-crash-expected.txt: Added.
* pointerevents/pointer-id-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (243234 => 243235)
--- trunk/LayoutTests/ChangeLog 2019-03-20 20:31:08 UTC (rev 243234)
+++ trunk/LayoutTests/ChangeLog 2019-03-20 20:35:25 UTC (rev 243235)
@@ -1,3 +1,15 @@
+2019-03-20 Antoine Quint <[email protected]>
+
+ REGRESSION(r240634): Element::hasPointerCapture() passes a JS-controlled value directly into a HashMap as a key
+ https://bugs.webkit.org/show_bug.cgi?id=195683
+
+ Reviewed by Alex Christensen.
+
+ Adding the test that was supposed to have landed along with r242893.
+
+ * pointerevents/pointer-id-crash-expected.txt: Added.
+ * pointerevents/pointer-id-crash.html: Added.
+
2019-03-20 Devin Rousso <[email protected]>
Unreviewed, fix test failures after r243161.
Added: trunk/LayoutTests/pointerevents/pointer-id-crash-expected.txt (0 => 243235)
--- trunk/LayoutTests/pointerevents/pointer-id-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/pointerevents/pointer-id-crash-expected.txt 2019-03-20 20:35:25 UTC (rev 243235)
@@ -0,0 +1,3 @@
+
+PASS Checking 0 can be used as a Pointer ID.
+
Added: trunk/LayoutTests/pointerevents/pointer-id-crash.html (0 => 243235)
--- trunk/LayoutTests/pointerevents/pointer-id-crash.html (rev 0)
+++ trunk/LayoutTests/pointerevents/pointer-id-crash.html 2019-03-20 20:35:25 UTC (rev 243235)
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset=utf-8>
+</head>
+<body>
+<script src=""
+<script src=""
+<script>
+
+'use strict';
+
+test(() => {
+ const element = document.body.appendChild(document.createElement("div"));
+ for (let value of [0, Number.MAX_VALUE, Number.MIN_VALUE, Number.MAX_VALUE + 1, Number.MIN_VALUE - 1]) {
+ element.hasPointerCapture(value);
+ assert_throws("NotFoundError", () => element.setPointerCapture(value))
+ assert_throws("NotFoundError", () => element.releasePointerCapture(value))
+ }
+ element.remove();
+}, "Checking 0 can be used as a Pointer ID.");
+
+</script>
+</body>
+</html>
\ No newline at end of file
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
