Chromium Code Reviews| OLD | NEW |
|---|---|
| (Empty) | |
| 1 <!-- This tests for regression of https://crbug.com/279277 where non-adjacent, n ested isolates caused a use-after-free if the elements were later removed. --> | |
|
leviw_travelin_and_unemployed
2013/09/04 22:00:24
<!doctype html>?
jww
2013/09/04 22:37:26
I'm happy to make all of the changes here, but thi
leviw_travelin_and_unemployed
2013/09/04 22:46:25
I'd say yes :)
jww
2013/09/04 23:12:15
Done.
| |
| 2 <script> | |
| 3 function remove(node) | |
|
leviw_travelin_and_unemployed
2013/09/04 22:00:24
This seems somewhat unnecessary.
jww
2013/09/04 22:37:26
See above response.
| |
| 4 { | |
| 5 node.parentNode.removeChild(node); | |
| 6 } | |
| 7 | |
| 8 window.onload = function() { | |
| 9 document.body.offsetTop; | |
| 10 remove(b.lastChild); | |
| 11 document.body.offsetTop; | |
| 12 remove(a.nextSibling); | |
| 13 document.body.offsetTop; | |
| 14 | |
| 15 document.body.appendChild(document.createTextNode("PASS did not crash")); | |
|
leviw_travelin_and_unemployed
2013/09/04 22:00:24
I'd probably just use document.write so "foo" and
jww
2013/09/04 22:37:26
See above response.
| |
| 16 } | |
| 17 </script> | |
| 18 | |
| 19 <body> | |
| 20 <div id="a">foo</div><div>baz</div><div></div> | |
| 21 <div> | |
| 22 <output> | |
| 23 <span> | |
| 24 <output>bar</output> | |
| 25 <span id="b"> | |
| 26 <span> | |
| 27 <div style="display:inline-block"></div> | |
| 28 <br><br> | |
| 29 </span> | |
| 30 </span> | |
| 31 </span> | |
| 32 </output> | |
| 33 </div> | |
| 34 </body> | |
| 35 | |
| 36 <script> | |
| 37 if (window.testRunner) | |
| 38 testRunner.dumpAsText(); | |
| 39 </script> | |
| OLD | NEW |