third_party/WebKit/LayoutTests/fast/dom/adopt-node-crash.html - Issue 2532393003: Remove the wrong optimization in replacing a text node with innerHTML

Side by Side Diff

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Side by Side Diff: third_party/WebKit/LayoutTests/fast/dom/adopt-node-crash.html

Issue 2532393003: Remove the wrong optimization in replacing a text node with innerHTML (Closed)

Patch Set: use NeedsRebaseline Created 4 years ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

OLD	NEW
	(Empty)
1 <!DOCTYPE html>

2 <div>Tests for a crash due to modifying the DOM during mutation events due to an adoptNode call. If this page doesn't crash and DOMSubtreeModified is fire, this test succeeds.</div>

3 <div id="result"></div>

4 <div id="node-to-adopt"></div>

5 <iframe></iframe>

6 <script>

7 if (window.testRunner)

8 testRunner.dumpAsText();

9

10 var nodeToAdopt = document.getElementById('node-to-adopt');

11

12 var mutationHandler = function() {

13 document.getElementById('result').innerHTML = "DOMSubtreeModified fired";

14 document.body.removeEventListener('DOMSubtreeModified', mutationHandler, tru e);

15 document.body.appendChild(nodeToAdopt);

16 };

17 document.body.addEventListener('DOMSubtreeModified', mutationHandler, true);

18

19 var iframe = document.querySelector('iframe');

20 var iframeDoc = iframe.contentDocument;

21 iframeDoc.adoptNode(nodeToAdopt);

22 // The crash happens when the iframe's document is getting detached.

23 document.body.removeChild(iframe);

24 </script>

OLD	NEW