| Index: third_party/WebKit/LayoutTests/shadow-dom/crashes/offsetParent-layoutObject-lifecycle.html
|
| diff --git a/third_party/WebKit/LayoutTests/shadow-dom/crashes/offsetParent-layoutObject-lifecycle.html b/third_party/WebKit/LayoutTests/shadow-dom/crashes/offsetParent-layoutObject-lifecycle.html
|
| new file mode 100644
|
| index 0000000000000000000000000000000000000000..8a1d08d554174522e6479ae4f3daa99047e9d8bf
|
| --- /dev/null
|
| +++ b/third_party/WebKit/LayoutTests/shadow-dom/crashes/offsetParent-layoutObject-lifecycle.html
|
| @@ -0,0 +1,25 @@
|
| +<!DOCTYPE html>
|
| +<script src='../../resources/testharness.js'></script>
|
| +<script src='../../resources/testharnessreport.js'></script>
|
| +<script>
|
| +// This case is created from reproduction case by cloudfuzzer.
|
| +window.addEventListener('load', () => {
|
| + test(() => {
|
| + var link = document.createElement('link');
|
| + link.setAttribute('rel','import');
|
| + document.head.appendChild(link);
|
| +
|
| + var style = document.createElement('style');
|
| + style.textContent = '@import url(x)';
|
| + document.head.appendChild(style);
|
| +
|
| + var frame = document.createElement('frame');
|
| + document.body.appendChild(frame);
|
| +
|
| + // This could cause crash.
|
| + frame.offsetHeight;
|
| + assert_true(true, 'This test must run without crash.');
|
| + }, "HTMLElement.offsetHeight should not cause crash.");
|
| +}, false);
|
| +</script>
|
| +<body></body>
|
|
|
Chromium Code Reviews
Issue 2148173002:
Fix layout object lifecycle in HTMLElement.offset* (Closed)
Base URL: https://chromium.googlesource.com/chromium/src.git@2785