REGRESSION(r240634): Element::hasPointerCapture() passes a JS-controlled value direct...
authorgraouts@webkit.org <graouts@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 20 Mar 2019 20:35:25 +0000 (20:35 +0000)
committergraouts@webkit.org <graouts@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 20 Mar 2019 20:35:25 +0000 (20:35 +0000)
https://bugs.webkit.org/show_bug.cgi?id=195683

Reviewed by Alex Christensen.

Adding the test that was supposed to have landed along with r242893.

* pointerevents/pointer-id-crash-expected.txt: Added.
* pointerevents/pointer-id-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243235 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/pointerevents/pointer-id-crash-expected.txt [new file with mode: 0644]
LayoutTests/pointerevents/pointer-id-crash.html [new file with mode: 0644]

index 16c2e20..596d4ca 100644 (file)
@@ -1,3 +1,15 @@
+2019-03-20  Antoine Quint  <graouts@apple.com>
+
+        REGRESSION(r240634): Element::hasPointerCapture() passes a JS-controlled value directly into a HashMap as a key
+        https://bugs.webkit.org/show_bug.cgi?id=195683
+
+        Reviewed by Alex Christensen.
+
+        Adding the test that was supposed to have landed along with r242893.
+
+        * pointerevents/pointer-id-crash-expected.txt: Added.
+        * pointerevents/pointer-id-crash.html: Added.
+
 2019-03-20  Devin Rousso  <drousso@apple.com>
 
         Unreviewed, fix test failures after r243161.
diff --git a/LayoutTests/pointerevents/pointer-id-crash-expected.txt b/LayoutTests/pointerevents/pointer-id-crash-expected.txt
new file mode 100644 (file)
index 0000000..3ba2b6c
--- /dev/null
@@ -0,0 +1,3 @@
+
+PASS Checking 0 can be used as a Pointer ID. 
+
diff --git a/LayoutTests/pointerevents/pointer-id-crash.html b/LayoutTests/pointerevents/pointer-id-crash.html
new file mode 100644 (file)
index 0000000..7063db4
--- /dev/null
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset=utf-8>
+</head>
+<body>
+<script src="../resources/testharness.js"></script>
+<script src="../resources/testharnessreport.js"></script>
+<script>
+
+'use strict';
+
+test(() => {
+    const element = document.body.appendChild(document.createElement("div"));
+    for (let value of [0, Number.MAX_VALUE, Number.MIN_VALUE, Number.MAX_VALUE + 1, Number.MIN_VALUE - 1]) {
+        element.hasPointerCapture(value);
+        assert_throws("NotFoundError", () => element.setPointerCapture(value))
+        assert_throws("NotFoundError", () => element.releasePointerCapture(value))
+    }
+    element.remove();
+}, "Checking 0 can be used as a Pointer ID.");
+
+</script>
+</body>
+</html>
\ No newline at end of file