OLD | NEW |
---|---|
(Empty) | |
1 <!-- This tests for regression of https://crbug.com/279277 where non-adjacent, n ested isolates caused a use-after-free if the elements were later removed. --> | |
leviw_travelin_and_unemployed
2013/09/04 22:00:24
<!doctype html>?
jww
2013/09/04 22:37:26
I'm happy to make all of the changes here, but thi
leviw_travelin_and_unemployed
2013/09/04 22:46:25
I'd say yes :)
jww
2013/09/04 23:12:15
Done.
| |
2 <script> | |
3 function remove(node) | |
leviw_travelin_and_unemployed
2013/09/04 22:00:24
This seems somewhat unnecessary.
jww
2013/09/04 22:37:26
See above response.
| |
4 { | |
5 node.parentNode.removeChild(node); | |
6 } | |
7 | |
8 window.onload = function() { | |
9 document.body.offsetTop; | |
10 remove(b.lastChild); | |
11 document.body.offsetTop; | |
12 remove(a.nextSibling); | |
13 document.body.offsetTop; | |
14 | |
15 document.body.appendChild(document.createTextNode("PASS did not crash")); | |
leviw_travelin_and_unemployed
2013/09/04 22:00:24
I'd probably just use document.write so "foo" and
jww
2013/09/04 22:37:26
See above response.
| |
16 } | |
17 </script> | |
18 | |
19 <body> | |
20 <div id="a">foo</div><div>baz</div><div></div> | |
21 <div> | |
22 <output> | |
23 <span> | |
24 <output>bar</output> | |
25 <span id="b"> | |
26 <span> | |
27 <div style="display:inline-block"></div> | |
28 <br><br> | |
29 </span> | |
30 </span> | |
31 </span> | |
32 </output> | |
33 </div> | |
34 </body> | |
35 | |
36 <script> | |
37 if (window.testRunner) | |
38 testRunner.dumpAsText(); | |
39 </script> | |
OLD | NEW |