| OLD | NEW |
|---|
| 1 <head> | 1 <head> |
| 2 <style> | 2 <style> |
| 3 .gone { display:none } | 3 .gone { display:none } |
| 4 </style> | 4 </style> |
| 5 <script> | 5 <script> |
| 6 if (window.testRunner) | 6 if (window.testRunner) |
| 7 testRunner.dumpAsText(); | 7 testRunner.dumpAsText(); |
| 8 </script> | 8 </script> |
| 9 <body> | 9 <body> |
| 10 Loading this page should not crash. | 10 Loading this page should not crash. |
| 11 <table> | 11 <table> |
| 12 <td id=td1> | 12 <td id=td1> |
| 13 .<input id=cb type="checkbox">. | 13 .<input id=cb type="checkbox">. |
| 14 </table> | 14 </table> |
| 15 <script> | 15 <script> |
| 16 var sel = window.getSelection(); | 16 var sel = window.getSelection(); |
| 17 var td1 = document.getElementById('td1') | 17 var td1 = document.getElementById('td1') |
| 18 // having selection triggers Document::updateRendering() from paint() | 18 // having selection triggers Document::updateRendering() from paint() |
| 19 sel.setBaseAndExtent(td1, 0, td1, 1000); | 19 sel.setBaseAndExtent(td1, 0, td1, 3); |
| 20 // this causes style recalc and rendering tree tear down (from updateRenderi
ng) in middle of painting, which crashes | 20 // this causes style recalc and rendering tree tear down (from updateRenderi
ng) in middle of painting, which crashes |
| 21 document.body.setAttribute('class','gone'); | 21 document.body.setAttribute('class','gone'); |
| 22 var cb = document.getElementById('cb') | 22 var cb = document.getElementById('cb') |
| 23 // this triggers synchronous paint() | 23 // this triggers synchronous paint() |
| 24 cb.click(); | 24 cb.click(); |
| 25 document.body.setAttribute('class',''); | 25 document.body.setAttribute('class',''); |
| 26 </script> | 26 </script> |
| 27 </body> | 27 </body> |
| 28 | 28 |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 2693813002:
Selection API: Some functions should throw InvalidNodeTypeError and IndexSizeError. (Closed)
