43 lines
1.2 KiB
HTML
43 lines
1.2 KiB
HTML
<html>
|
|
<head>
|
|
<script>
|
|
function openIframe()
|
|
{
|
|
if (document.createElement && (iframe = document.createElement('iframe'))) {
|
|
document.body.appendChild(iframe);
|
|
return iframe;
|
|
}
|
|
}
|
|
|
|
function runTestOuterText() {
|
|
t1 = openIframe();
|
|
var a = t1.contentWindow.frames;
|
|
var b = t1.contentDocument.defaultView.localStorage;
|
|
var a_localStorage = a.localStorage; // The constructor won't be reachable as window object property after detaching the frame.
|
|
|
|
t1.outerText = "";
|
|
try {
|
|
a_localStorage.fuzz3_visited="test";
|
|
} catch (e) {
|
|
console.log("Expected exception caught.");
|
|
}
|
|
}
|
|
|
|
function runTests() {
|
|
runTestOuterText();
|
|
document.getElementById("result").innerHTML = "passed";
|
|
}
|
|
|
|
if (window.testRunner)
|
|
testRunner.dumpAsText();
|
|
|
|
</script>
|
|
</head>
|
|
<body onload="runTests()">
|
|
<p>Bug: https://bugs.webkit.org/show_bug.cgi?id=57140
|
|
<p>Description: Crash from null pointer dereference below WebCore::StorageAreaImpl::setItem()
|
|
<p>Expect: passed
|
|
<p>Result: <span id="result">failed</span>
|
|
</body>
|
|
</html>
|