Title: [142548] trunk/LayoutTests
- Revision
- 142548
- Author
- [email protected]
- Date
- 2013-02-11 16:36:45 -0800 (Mon, 11 Feb 2013)
Log Message
SVG DOM manipulation crash
https://bugs.webkit.org/show_bug.cgi?id=108709
Reviewed by Eric Seidel.
Adding a test for the case where an SVG <use> tree is rebuild due to
one event listener and a subsequent listener tries to access it. This
does not crash in WebKit but has caused problems in browser code where
the listener tries to access and use toNode on the target of the
event. The test prevents regressions and gives automated security
tests something to work on.
* svg/custom/use-listener-append-crash-expected.txt: Added.
* svg/custom/use-listener-append-crash.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (142547 => 142548)
--- trunk/LayoutTests/ChangeLog 2013-02-12 00:33:32 UTC (rev 142547)
+++ trunk/LayoutTests/ChangeLog 2013-02-12 00:36:45 UTC (rev 142548)
@@ -1,3 +1,20 @@
+2013-02-11 Stephen Chenney <[email protected]>
+
+ SVG DOM manipulation crash
+ https://bugs.webkit.org/show_bug.cgi?id=108709
+
+ Reviewed by Eric Seidel.
+
+ Adding a test for the case where an SVG <use> tree is rebuild due to
+ one event listener and a subsequent listener tries to access it. This
+ does not crash in WebKit but has caused problems in browser code where
+ the listener tries to access and use toNode on the target of the
+ event. The test prevents regressions and gives automated security
+ tests something to work on.
+
+ * svg/custom/use-listener-append-crash-expected.txt: Added.
+ * svg/custom/use-listener-append-crash.html: Added.
+
2013-02-11 Filip Pizlo <[email protected]>
Strange bug in DFG OSR in JSC
Added: trunk/LayoutTests/svg/custom/use-listener-append-crash-expected.txt (0 => 142548)
--- trunk/LayoutTests/svg/custom/use-listener-append-crash-expected.txt (rev 0)
+++ trunk/LayoutTests/svg/custom/use-listener-append-crash-expected.txt 2013-02-12 00:36:45 UTC (rev 142548)
@@ -0,0 +1 @@
+Test re-appending a use node with multiple event listeners, triggered by the first listener. If running manually, click on the left square. Pass if no crash and the visible result is an orange square left of a green square.
Added: trunk/LayoutTests/svg/custom/use-listener-append-crash.html (0 => 142548)
--- trunk/LayoutTests/svg/custom/use-listener-append-crash.html (rev 0)
+++ trunk/LayoutTests/svg/custom/use-listener-append-crash.html 2013-02-12 00:36:45 UTC (rev 142548)
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<svg width=80 height=40>
+ <defs>
+ <rect id="square" x=4 y=4 width=32 height=32 fill=orange></rect>
+ </defs>
+
+ <use id="leftSquare" xlink:href=""
+ <use xlink:href="" x=40></use>
+</svg>
+
+<script>
+ if (window.testRunner)
+ testRunner.dumpAsText();
+
+ leftSquare.addEventListener('mousedown', function() { leftSquare.parentNode.appendChild(leftSquare); });
+ leftSquare.addEventListener('mousedown', function() { leftSquare.instanceRoot.correspondingElement.setAttribute("fill", "green"); });
+
+ if (window.eventSender) {
+ eventSender.mouseMoveTo(20, 20);
+ eventSender.mouseDown();
+ eventSender.mouseUp();
+ }
+</script>
+<p>Test re-appending a use node with multiple event listeners, triggered by the first listener.
+ If running manually, click on the left square.
+ Pass if no crash and the visible result is an orange square left of a green square.</p>
+</html>
\ No newline at end of file
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
