Merge r166645 - Add LayoutTest for crash with bidi isolates

Merged from Blink (patch by jww@chromium.org): https://src.chromium.org/viewvc/blink?revision=156580&view=revision http://crbug.com/265838 See Bug 120504: Fix nested unicode-bidi: isolate <https://bugs.webkit.org/show_bug.cgi?id=120504> <http://trac.webkit.org/changeset/155554> * fast/text/international/unicode-bidi-isolate-nested-with-removes-expected.txt: Added. * fast/text/international/unicode-bidi-isolate-nested-with-removes.html: Added.
WebKit · May 5, 2014 · 66c0d46 · 66c0d46
1 parent e3a8233
commit 66c0d46
Show file tree

Hide file tree

Showing 3 changed files with 55 additions and 0 deletions.
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
@@ -1,3 +1,18 @@
+2014-04-02  David Kilzer  <ddkilzer@apple.com>
+
+        Add LayoutTest for crash with bidi isolates
+
+        Merged from Blink (patch by jww@chromium.org):
+        https://src.chromium.org/viewvc/blink?revision=156580&view=revision
+        http://crbug.com/265838
+
+        See Bug 120504: Fix nested unicode-bidi: isolate
+        <https://bugs.webkit.org/show_bug.cgi?id=120504>
+        <http://trac.webkit.org/changeset/155554>
+
+        * fast/text/international/unicode-bidi-isolate-nested-with-removes-expected.txt: Added.
+        * fast/text/international/unicode-bidi-isolate-nested-with-removes.html: Added.
+
 2014-04-01  Daniel Bates  <dabates@apple.com>
 
         RenderQuote must destroy remaining text renderer before first letter renderer

diff --git a/LayoutTests/fast/text/international/unicode-bidi-isolate-nested-with-removes-expected.txt b/LayoutTests/fast/text/international/unicode-bidi-isolate-nested-with-removes-expected.txt
@@ -0,0 +1,4 @@
+ bar                      
+
+
+PASS did not crash
diff --git a/LayoutTests/fast/text/international/unicode-bidi-isolate-nested-with-removes.html b/LayoutTests/fast/text/international/unicode-bidi-isolate-nested-with-removes.html
@@ -0,0 +1,36 @@
+<!-- This tests for regression of https://crbug.com/265838 where adjacent, nested isolates caused a use-after-free if the elements were later removed. -->
+<script>
+function remove(node)
+{
+    node.parentNode.removeChild(node);
+}
+
+window.onload = function()
+{
+    document.body.offsetTop;
+    remove(b.lastChild);
+    document.body.offsetTop;
+    remove(a.firstChild);
+    document.body.offsetTop;
+
+    document.body.appendChild(document.createTextNode("PASS did not crash"));
+}
+</script>
+
+<body>
+  <div id="a">foo</div>
+  <div></div>
+  <div>
+    <output>
+        <output>bar</output>
+        <span id="b">
+            <span><div style="display:inline-block"></div><br><br><br></span>
+        </span>
+    </output>
+  </div>
+</body>
+
+<script>
+if (window.testRunner)
+    testRunner.dumpAsText();
+</script>