Chromium Code Reviews| OLD | NEW |
|---|---|
| (Empty) | |
| 1 <!DOCTYPE html> | |
|
hayato
2016/07/07 03:27:19
Could you move this file to shadow-dom/crashes/ ?
kochi
2016/07/07 03:39:07
Done.
| |
| 2 <script src='../resources/testharness.js'></script> | |
| 3 <script src='../resources/testharnessreport.js'></script> | |
| 4 <script> | |
| 5 // This case is created from reproduction case by cloudfuzzer. | |
| 6 function f() { | |
| 7 test(() => { | |
| 8 var link = document.createElement('link'); | |
| 9 link.setAttribute('rel','import'); | |
| 10 document.head.appendChild(link); | |
| 11 | |
| 12 var style = document.createElement('style'); | |
| 13 style.textContent = '@import url(x)'; | |
| 14 document.head.appendChild(style); | |
| 15 | |
| 16 var frame = document.createElement('frame'); | |
| 17 document.body.appendChild(frame); | |
| 18 | |
| 19 // This could cause crash. | |
| 20 frame.offsetHeight; | |
| 21 assert_true(true, 'This test must run without crash.'); | |
| 22 }, "HTMLElement.offsetHeight should not cause crash."); | |
| 23 } | |
| 24 </script> | |
| 25 <body onload="f()"></body> | |
|
hayato
2016/07/07 03:27:19
Use window.addEventListener, instead of <body onlo
kochi
2016/07/07 03:39:07
Done.
| |
| OLD | NEW |