REGRESSION(r240634): Element::hasPointerCapture() passes a JS-controlled value direct...
authorgraouts@webkit.org <graouts@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 20 Mar 2019 20:35:25 +0000 (20:35 +0000)
committergraouts@webkit.org <graouts@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 20 Mar 2019 20:35:25 +0000 (20:35 +0000)
commit8aa2fe65c4c903c2fcba082fd45ea9223236cec2
tree57b8b0ff1de0a9255a77dd84027a15a2fb1b01f0
parentb076ced54bb5bc361c484c96dda6e6bcf4764945
REGRESSION(r240634): Element::hasPointerCapture() passes a JS-controlled value directly into a HashMap as a key
https://bugs.webkit.org/show_bug.cgi?id=195683

Reviewed by Alex Christensen.

Adding the test that was supposed to have landed along with r242893.

* pointerevents/pointer-id-crash-expected.txt: Added.
* pointerevents/pointer-id-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243235 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/pointerevents/pointer-id-crash-expected.txt [new file with mode: 0644]
LayoutTests/pointerevents/pointer-id-crash.html [new file with mode: 0644]