haikuwebkit/ManualTests/tap-gesture-in-iframe-with-...

<html>
<body>
    <p>This test verifies that touch gesture on an iframe does not crash when tap highlighting is on.</p>
    <p style='color:green'>Tapping on the iframe should not crash.</p>
    <iframe src='data:text/html,
        <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
        <html>
        <body style="margin: 0px;"></body>
        </html>'>
    </iframe>
</body>
</html>
Fix defective size_t overflow in GestureTapHighlighter. https://bugs.webkit.org/show_bug.cgi?id=82605 Patch by Zalan Bujtas <zbujtas@gmail.com> on 2012-03-30 Reviewed by Kenneth Rohde Christiansen. .: * ManualTests/tap-gesture-in-iframe-with-tap-highlight-crash.html: Added. Source/WebCore: In pathForRenderer, the for loop has 'i < rects().size() - 1' as test expression, where rects().size() returns with size_t. In case of empty rect, it leads to unsigned int overflow. Overflow value makes the associated for loop run with invalid values. Fix it by making loop variable int and stop using size_t type in the test expression. Also, return early, if no focus ring found. Manual test added. Tap gesture highlighter is getting triggered by UI process. * page/GestureTapHighlighter.cpp: Canonical link: https://commits.webkit.org/100103@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@112723 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2012-03-30 20:55:48 +00:00			`<html>`
			`<body>`
			`<p>This test verifies that touch gesture on an iframe does not crash when tap highlighting is on.</p>`
			`<p style='color:green'>Tapping on the iframe should not crash.</p>`
			`<iframe src='data:text/html,`
			`<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">`
			`<html>`
			`<body style="margin: 0px;"></body>`
			`</html>'>`
			`</iframe>`
			`</body>`
			`</html>`