blob: 6e3dbc1d77f5679c65fd1b382cbbc26307f50ed4 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
|
<html>
<head>
<script>
function openIframe()
{
if (document.createElement && (iframe = document.createElement('iframe'))) {
document.body.appendChild(iframe);
return iframe;
}
}
function runTestOuterText() {
t1 = openIframe();
var a = t1.contentWindow.frames;
var b = t1.contentDocument.defaultView.localStorage;
var a_localStorage = a.localStorage; // The constructor won't be reachable as window object property after detaching the frame.
t1.outerText = "";
try {
a_localStorage.fuzz3_visited="test";
} catch (e) {
console.log("Expected exception caught.");
}
}
function runTests() {
runTestOuterText();
document.getElementById("result").innerHTML = "passed";
}
if (window.testRunner)
testRunner.dumpAsText();
</script>
</head>
<body onload="runTests()">
<p>Bug: https://bugs.webkit.org/show_bug.cgi?id=57140
<p>Description: Crash from null pointer dereference below WebCore::StorageAreaImpl::setItem()
<p>Expect: passed
<p>Result: <span id="result">failed</span>
</body>
</html>
|
