Changeset 243235 in webkit

Timestamp:

Mar 20, 2019, 1:35:25 PM (7 years ago)

Author:

graouts@webkit.org

Message:

REGRESSION(r240634): Element::hasPointerCapture() passes a JS-controlled value directly into a HashMap as a key
​https://bugs.webkit.org/show_bug.cgi?id=195683

Reviewed by Alex Christensen.

Adding the test that was supposed to have landed along with r242893.

• pointerevents/pointer-id-crash-expected.txt: Added.
• pointerevents/pointer-id-crash.html: Added.

Location:

trunk/LayoutTests

Files:

• ChangeLog (modified) (1 diff)
• pointerevents/pointer-id-crash-expected.txt (added)
• pointerevents/pointer-id-crash.html (added)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2019-03-20  Antoine Quint  <graouts@apple.com>
+
+        REGRESSION(r240634): Element::hasPointerCapture() passes a JS-controlled value directly into a HashMap as a key
+        https://bugs.webkit.org/show_bug.cgi?id=195683
+
+        Reviewed by Alex Christensen.
+
+        Adding the test that was supposed to have landed along with r242893.
+
+        * pointerevents/pointer-id-crash-expected.txt: Added.
+        * pointerevents/pointer-id-crash.html: Added.
+
 2019-03-20  Devin Rousso  <drousso@apple.com>