| OLD | NEW |
|---|
| 1 <html> | 1 <html> |
| 2 <p>This test must not crash.</p> | 2 <p>This test must not crash.</p> |
| 3 <script> | 3 <script> |
| 4 if (window.testRunner) | 4 if (window.testRunner) |
| 5 testRunner.dumpAsText(); | 5 testRunner.dumpAsText(); |
| 6 | 6 |
| 7 function f1() { | 7 function f1() { |
| 8 document.write('<form>'); //Here we need the form tag to trigger the bug | 8 document.write('<form>'); //Here we need the form tag to trigger the bug |
| 9 document.getElementsByTagName("s")[0].innerHTML = 'foo'; | 9 document.getElementsByTagName("s")[0].innerHTML = 'foo'; |
| 10 } | 10 } |
| 11 | 11 |
| 12 function f2() { | 12 function f2() { |
| 13 document.getElementsByTagName("kbd")[0].innerHTML = 'foo'; | 13 document.getElementsByTagName("kbd")[0].innerHTML = 'foo'; |
| 14 document.getElementsByTagName("kbd")[0].insertBefore(document.createElement(
'foo'),document.createElement('foo')); | 14 document.getElementsByTagName("kbd")[0].insertBefore(document.createElement(
'foo'),document.createElement('foo')); |
| 15 } | 15 } |
| 16 </script> | 16 </script> |
| 17 <s> | 17 <s> |
| 18 <!-- The following weird mark-up is needed to reproduce the crash --> | 18 <!-- The following weird mark-up is needed to reproduce the crash --> |
| 19 <script>f1();</script> | 19 <script>f1();</script> |
| 20 <xmp><mark> | 20 <xmp><mark> |
| 21 <script>f1();</script> | 21 <script>f1();</script> |
| 22 <xmp></xmp> | 22 <xmp></xmp> |
| 23 <kbd> | 23 <kbd> |
| 24 <script>f2();</script> | 24 <script>f2();</script> |
| 25 </kbd> | 25 </kbd> |
| 26 </s> | 26 </s> |
| 27 </html> | 27 </html> |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 11573057:
Merge 137702 (Closed)
Base URL: http://svn.webkit.org/repository/webkit/branches/chromium/1312/