Title: [288323] trunk/LayoutTests
- Revision
- 288323
- Author
- [email protected]
- Date
- 2022-01-20 14:04:12 -0800 (Thu, 20 Jan 2022)
Log Message
Mark range boundary point containers
https://bugs.webkit.org/show_bug.cgi?id=233462
Patch by Rob Buis <[email protected]> on 2022-01-20
Reviewed by Darin Adler.
Add test that should have been part of r287131. Caught by Adrian.
* fast/dom/Range/delete-contents-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (288322 => 288323)
--- trunk/LayoutTests/ChangeLog 2022-01-20 21:36:40 UTC (rev 288322)
+++ trunk/LayoutTests/ChangeLog 2022-01-20 22:04:12 UTC (rev 288323)
@@ -1,3 +1,14 @@
+2022-01-20 Rob Buis <[email protected]>
+
+ Mark range boundary point containers
+ https://bugs.webkit.org/show_bug.cgi?id=233462
+
+ Reviewed by Darin Adler.
+
+ Add test that should have been part of r287131. Caught by Adrian.
+
+ * fast/dom/Range/delete-contents-crash.html: Added.
+
2022-01-20 Kimmo Kinnunen <[email protected]>
Implement WebGL GPU buffer texture upload path for Cocoa getUserMedia camera streams
Added: trunk/LayoutTests/fast/dom/Range/delete-contents-crash.html (0 => 288323)
--- trunk/LayoutTests/fast/dom/Range/delete-contents-crash.html (rev 0)
+++ trunk/LayoutTests/fast/dom/Range/delete-contents-crash.html 2022-01-20 22:04:12 UTC (rev 288323)
@@ -0,0 +1,29 @@
+<script id='s0' src=''>
+</script>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+_onload_ = async () => {
+ let head = document.head;
+ head.isAlive = true;
+ let div0 = document.createElement('div');
+ s0.appendChild(div0);
+ let div1 = document.createElement('div');
+ document.head.appendChild(div1);
+ let div2 = document.createElement('div');
+ div1.appendChild(div2);
+ document.head.remove();
+ let range = new Range();
+ range.setStartAfter(div2);
+ range.setStartBefore(div0);
+ await Promise.resolve();
+ GCController.collect();
+ range.deleteContents();
+ if (!head.isAlive)
+ document.write('FAIL: !head.isAlive');
+ else if (range.commonAncestorContainer != head)
+ document.write('FAIL: range.commonAncestorContainer != head');
+ else
+ document.write('PASS: Test did not crash.');
+};
+</script>
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
