blob: 6527d5d80c00a6a70a10332f8d09ad6c252abbd3 [file] [log] [blame]
<html xmlns="http://www.w3.org/1999/xhtml" xlink="http://www.w3.org/1999/xlink">
<body>
<svg version="1.1" xlink="http://www.w3.org/1999/xlink" width="100%" xmlns="http://www.w3.org/2000/svg">
<g>
<defs>
<font horiz-adv-x="224" id="embeded">
<font-face font-family="embeded" id="fontWillBeRemoved"></font-face>
<glyph horiz-adv-x="1500" unicode="1"></glyph>
<glyph horiz-adv-x="1500" unicode="2"></glyph>
<glyph horiz-adv-x="1500" unicode="3"></glyph>
<glyph horiz-adv-x="1500" unicode="4"></glyph>
<glyph horiz-adv-x="1500" unicode="fi"></glyph>
</font>
</defs>
<g>
<use id="use"></use>
<text font-family="embeded" id="text">fi1234</text>
</g>
</g>
</svg>
</body>
<script>
// crbug.com/352178: Heap-use-after-free in WebCore::SVGFontFaceElement::associatedFontElement.
// PASS if no crash occurs.
if (window.testRunner)
window.testRunner.dumpAsText();
document.execCommand("SelectAll");
function runTest() {
setTimeout(function() {
var fontWillBeRemoved = document.getElementById("fontWillBeRemoved");
var use = document.getElementById("use");
var text = document.getElementById("text");
fontWillBeRemoved.parentNode.removeChild(fontWillBeRemoved);
delete fontWillBeRemoved;
fontWillBeRemoved = null;
gc();
use.appendChild(text);
}, 0);
}
document.addEventListener("DOMContentLoaded", runTest, false);
</script>
</html>