Index: LayoutTests/fast/dom/shadow/access-document-of-detached-stylesheetlist-crash.html |
diff --git a/LayoutTests/fast/dom/shadow/access-document-of-detached-stylesheetlist-crash.html b/LayoutTests/fast/dom/shadow/access-document-of-detached-stylesheetlist-crash.html |
new file mode 100644 |
index 0000000000000000000000000000000000000000..78625cacc09844335c8299be532e42eaaba7074e |
--- /dev/null |
+++ b/LayoutTests/fast/dom/shadow/access-document-of-detached-stylesheetlist-crash.html |
@@ -0,0 +1,36 @@ |
+<!DOCTYPE html> |
+<html> |
+<head> |
+<script src="../../../resources/js-test.js"></script> |
+<script> |
+if (window.testRunner) |
+ testRunner.waitUntilDone(); |
+ |
+function runTest() |
+{ |
+ var host = document.getElementById('host'); |
+ var sr = host.createShadowRoot(); |
+ sr.innerHTML = '<style>background-color: red;</style><div>Shadow</div>'; |
+ |
+ // Need to use ShadowRoot.styleSheets API to create a styleSheetList. |
+ sr.styleSheets.length; |
+ host.parentNode.removeChild(host); |
+ |
+ setTimeout(function() { |
+ gc(); |
+ gc(); // FIXME: remove one gc() after refactoring gc()'s c++ code. |
+ |
+ if (window.testRunner) |
+ testRunner.notifyDone(); |
+ }, 0); |
+} |
+</script> |
+</head> |
+<body onload="runTest()"> |
+ <div id='host'></div> |
+ <pre id='console'></pre> |
+</body> |
+<script> |
+description('Test for crbug.com/337059: accessing StyleSheetList::document() from GC causes crash.'); |
+</script> |
+</html> |