ASSERT_WITH_SECURITY_IMPLICATION in WebCore::DocumentOrderedMap::add()
authordbates@webkit.org <dbates@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 3 Dec 2015 18:49:50 +0000 (18:49 +0000)
committerdbates@webkit.org <dbates@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 3 Dec 2015 18:49:50 +0000 (18:49 +0000)
https://bugs.webkit.org/show_bug.cgi?id=126662
<rdar://problem/15775508>

Reviewed by Brent Fulgham.

Add test to ensure that we do not assert when inserting a subtree that has an element with
a duplicate id before removing the original subtree.

* svg/custom/insert-subtree-with-duplicate-id-before-removing-subtree-expected.txt: Added.
* svg/custom/insert-subtree-with-duplicate-id-before-removing-subtree.svg: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@193134 268f45cc-cd09-0410-ab3c-d52691b4dbfc

LayoutTests/ChangeLog
LayoutTests/svg/custom/insert-subtree-with-duplicate-id-before-removing-subtree-expected.txt [new file with mode: 0644]
LayoutTests/svg/custom/insert-subtree-with-duplicate-id-before-removing-subtree.html [new file with mode: 0644]

index 38a03c6..ca42bc9 100644 (file)
@@ -1,3 +1,17 @@
+2015-12-03  Daniel Bates  <dabates@apple.com>
+
+        ASSERT_WITH_SECURITY_IMPLICATION in WebCore::DocumentOrderedMap::add()
+        https://bugs.webkit.org/show_bug.cgi?id=126662
+        <rdar://problem/15775508>
+
+        Reviewed by Brent Fulgham.
+
+        Add test to ensure that we do not assert when inserting a subtree that has an element with
+        a duplicate id before removing the original subtree.
+
+        * svg/custom/insert-subtree-with-duplicate-id-before-removing-subtree-expected.txt: Added.
+        * svg/custom/insert-subtree-with-duplicate-id-before-removing-subtree.svg: Added.
+
 2015-12-03  Javier Fernandez  <jfernandez@igalia.com>
 
         [css-grid] margin-left:auto and margin-top:auto discards the margin on opposite side
diff --git a/LayoutTests/svg/custom/insert-subtree-with-duplicate-id-before-removing-subtree-expected.txt b/LayoutTests/svg/custom/insert-subtree-with-duplicate-id-before-removing-subtree-expected.txt
new file mode 100644 (file)
index 0000000..5110e58
--- /dev/null
@@ -0,0 +1 @@
+This test PASSED if it does not crash.
diff --git a/LayoutTests/svg/custom/insert-subtree-with-duplicate-id-before-removing-subtree.html b/LayoutTests/svg/custom/insert-subtree-with-duplicate-id-before-removing-subtree.html
new file mode 100644 (file)
index 0000000..36f9827
--- /dev/null
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<svg>
+    <g id="a">
+        <use/>
+    </g>
+    <use xlink:href="#a"/>
+    <text x="0" y="20">This test PASSED if it does not crash.</text>
+    <script>
+        if (window.testRunner)
+            testRunner.dumpAsText();
+        var body = document.body;
+        var parent = body.parentNode;
+        var newElement = document.createElement("dir");
+        newElement.innerHTML = body.innerHTML;
+        parent.insertBefore(newElement, body);
+        parent.removeChild(body);
+    </script>
+</svg>
+</html>