| OLD | NEW |
|---|
| 1 <!DOCTYPE html> | 1 <!DOCTYPE html> |
| 2 <html> | 2 <html> |
| 3 <body> | 3 <body> |
| 4 <div>Test passes if it does not crash.</div> | 4 <div>Test passes if it does not crash.</div> |
| 5 <script> | 5 <script> |
| 6 if (window.testRunner) { | 6 if (window.testRunner) { |
| 7 testRunner.dumpAsText(); | 7 testRunner.dumpAsText(); |
| 8 testRunner.waitUntilDone(); | 8 testRunner.waitUntilDone(); |
| 9 } | 9 } |
| 10 | 10 |
| 11 function reloadUntil(max) { | 11 function reloadUntil(max) { |
| 12 var index = window.location.href.indexOf("?"); | 12 var index = window.location.href.indexOf("?"); |
| 13 if (index == -1) { | 13 if (index == -1) { |
| 14 window.location.href = window.location.href + "?1"; | 14 window.location.href = window.location.href + "?1"; |
| 15 } else { | 15 } else { |
| 16 var num = parseInt(window.location.href.substring(index + 1)); | 16 var num = parseInt(window.location.href.substring(index + 1)); |
| 17 if (num == max) { | 17 if (num == max) { |
| 18 if (window.testRunner) | 18 if (window.testRunner) |
| 19 testRunner.notifyDone(); | 19 testRunner.notifyDone(); |
| 20 } else { | 20 } else { |
| 21 window.location.href = window.location.href.substring(0, index + 1)
+ (num + 1); | 21 window.location.href = window.location.href.substring(0, index + 1)
+ (num + 1); |
| 22 } | 22 } |
| 23 } | 23 } |
| 24 } | 24 } |
| 25 | 25 |
| 26 function init() { | 26 function init() { |
| 27 var shadowHost = document.createElement("SHADOWHOST"); | 27 var shadowHost = document.createElement("SHADOWHOST"); |
| 28 var shadowRoot = shadowHost.createShadowRoot(); | 28 var shadowRoot = shadowHost.webkitCreateShadowRoot(); |
| 29 var child = document.createElement("CHILD"); | 29 var child = document.createElement("CHILD"); |
| 30 shadowRoot.appendChild(child); | 30 shadowRoot.appendChild(child); |
| 31 child.style.zoom = 34; | 31 child.style.zoom = 34; |
| 32 var styleAttr = child.attributes[0]; | 32 var styleAttr = child.attributes[0]; |
| 33 child.removeAttribute("style"); | 33 child.removeAttribute("style"); |
| 34 shadowHost.appendChild(shadowRoot); | 34 shadowHost.appendChild(shadowRoot); |
| 35 | 35 |
| 36 // The crash (use-after-free) is flaky. We have to reload the page a number
of times to reproduce the crash. | 36 // The crash (use-after-free) is flaky. We have to reload the page a number
of times to reproduce the crash. |
| 37 // I couldn't find a reliable way to reproduce, such as using gc(), adjustin
g the scopes of variables and so on. | 37 // I couldn't find a reliable way to reproduce, such as using gc(), adjustin
g the scopes of variables and so on. |
| 38 // As of now, we can hit a crash by reloading about 50 times. | 38 // As of now, we can hit a crash by reloading about 50 times. |
| 39 reloadUntil(80); | 39 reloadUntil(80); |
| 40 } | 40 } |
| 41 | 41 |
| 42 document.addEventListener("DOMContentLoaded", init, false); | 42 document.addEventListener("DOMContentLoaded", init, false); |
| 43 </script> | 43 </script> |
| 44 </body> | 44 </body> |
| 45 </html> | 45 </html> |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 220123005:
Revert of Re-landing r170008, removing prefixed Shadow DOM APIs in Element. (Closed)
Base URL: svn://svn.chromium.org/blink/trunk