Changeset 142548 in webkit

Timestamp:

Feb 11, 2013 4:36:45 PM (11 years ago)

Author:

schenney@chromium.org

Message:

SVG DOM manipulation crash
​https://bugs.webkit.org/show_bug.cgi?id=108709

Reviewed by Eric Seidel.

Adding a test for the case where an SVG <use> tree is rebuild due to
one event listener and a subsequent listener tries to access it. This
does not crash in WebKit but has caused problems in browser code where
the listener tries to access and use toNode on the target of the
event. The test prevents regressions and gives automated security
tests something to work on.

• svg/custom/use-listener-append-crash-expected.txt: Added.
• svg/custom/use-listener-append-crash.html: Added.

Location:

trunk/LayoutTests

Files:

• ChangeLog (modified) (1 diff)
• svg/custom/use-listener-append-crash-expected.txt (added)
• svg/custom/use-listener-append-crash.html (added)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2013-02-11  Stephen Chenney  <schenney@chromium.org>
+
+        SVG DOM manipulation crash
+        https://bugs.webkit.org/show_bug.cgi?id=108709
+
+        Reviewed by Eric Seidel.
+
+        Adding a test for the case where an SVG <use> tree is rebuild due to
+        one event listener and a subsequent listener tries to access it. This
+        does not crash in WebKit but has caused problems in browser code where
+        the listener tries to access and use toNode on the target of the
+        event. The test prevents regressions and gives automated security
+        tests something to work on.
+
+        * svg/custom/use-listener-append-crash-expected.txt: Added.
+        * svg/custom/use-listener-append-crash.html: Added.
+
 2013-02-11  Filip Pizlo  <fpizlo@apple.com>