From 678de4acf72e6fd4c6fb9426d2c69445acc18135 Mon Sep 17 00:00:00 2001 From: Ben Murdoch Date: Wed, 30 May 2012 16:07:49 +0100 Subject: Fix document.createTouchList crash. Cherry pick of WebKit r119158. Note the layout test is tweaked slighly from upstream to make it happy in our older webkit snapshot. See: http://trac.webkit.org/changeset/119158 Bug: 6578213 Change-Id: Id6cc23938b5139cf0416e3d4c6e7ba227b1b6a0c --- .../document-create-touch-list-crash-expected.txt | 19 +++++++++++++++++++ .../touch/document-create-touch-list-crash.html | 18 ++++++++++++++++++ .../script-tests/document-create-touch-list-crash.js | 20 ++++++++++++++++++++ 3 files changed, 57 insertions(+) create mode 100644 LayoutTests/fast/events/touch/document-create-touch-list-crash-expected.txt create mode 100644 LayoutTests/fast/events/touch/document-create-touch-list-crash.html create mode 100644 LayoutTests/fast/events/touch/script-tests/document-create-touch-list-crash.js (limited to 'LayoutTests') diff --git a/LayoutTests/fast/events/touch/document-create-touch-list-crash-expected.txt b/LayoutTests/fast/events/touch/document-create-touch-list-crash-expected.txt new file mode 100644 index 0000000..848712a --- /dev/null +++ b/LayoutTests/fast/events/touch/document-create-touch-list-crash-expected.txt @@ -0,0 +1,19 @@ +This test ensures that WebKit doesn't crash when the document.createTouchList API is called with non-Touch parameters + +On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE". + + +PASS document.createTouchList(document).item(0) is null +PASS document.createTouchList({"a":1}).item(0) is null +PASS document.createTouchList(new Array(5)).item(0) is null +PASS document.createTouchList("string").item(0) is null +PASS document.createTouchList(null).item(0) is null +PASS document.createTouchList(undefined).item(0) is null +PASS tl.length is 3 +PASS tl.item(0) is non-null. +PASS tl.item(1) is null +PASS tl.item(2) is non-null. +PASS successfullyParsed is true + +TEST COMPLETE + diff --git a/LayoutTests/fast/events/touch/document-create-touch-list-crash.html b/LayoutTests/fast/events/touch/document-create-touch-list-crash.html new file mode 100644 index 0000000..9204abb --- /dev/null +++ b/LayoutTests/fast/events/touch/document-create-touch-list-crash.html @@ -0,0 +1,18 @@ + + + + + + + + + +

+ + + diff --git a/LayoutTests/fast/events/touch/script-tests/document-create-touch-list-crash.js b/LayoutTests/fast/events/touch/script-tests/document-create-touch-list-crash.js new file mode 100644 index 0000000..19cf913 --- /dev/null +++ b/LayoutTests/fast/events/touch/script-tests/document-create-touch-list-crash.js @@ -0,0 +1,20 @@ +description("This test ensures that WebKit doesn't crash when the document.createTouchList API is called with non-Touch parameters"); + +shouldBeNull('document.createTouchList(document).item(0)'); +shouldBeNull('document.createTouchList({"a":1}).item(0)'); +shouldBeNull('document.createTouchList(new Array(5)).item(0)'); +shouldBeNull('document.createTouchList("string").item(0)'); +shouldBeNull('document.createTouchList(null).item(0)'); +shouldBeNull('document.createTouchList(undefined).item(0)'); + +var t = document.createTouch(window, document.body, 12341, 60, 65, 100, 105); +var t2 = document.createTouch(window, document.body, 12342, 50, 55, 115, 120); +var tl = document.createTouchList(t, document, t2); + +shouldBe('tl.length', '3'); +shouldBeNonNull('tl.item(0)'); +shouldBeNull('tl.item(1)'); +shouldBeNonNull('tl.item(2)'); + +successfullyParsed = true; +isSuccessfullyParsed(); -- cgit v1.1