Index: LayoutTests/fast/dom/Attr/update-attribute-node-no-crash.html |
diff --git a/LayoutTests/fast/dom/Attr/update-attribute-node-no-crash.html b/LayoutTests/fast/dom/Attr/update-attribute-node-no-crash.html |
new file mode 100644 |
index 0000000000000000000000000000000000000000..d3727cbf5a04dcbc38364e1d1396391d345c01ca |
--- /dev/null |
+++ b/LayoutTests/fast/dom/Attr/update-attribute-node-no-crash.html |
@@ -0,0 +1,20 @@ |
+<!DOCTYPE HTML> |
+<html> |
+<head> |
+<script src="../../../resources/js-test.js"></script> |
+</head> |
+<body> |
+<iframe></iframe> |
+<div id="test" style="background-color: red"></div> |
+<script> |
+description("Updating value of replaced attribute node"); |
+var element = document.getElementById("test"); |
+var attr = document.createAttribute("STYLE"); |
+shouldBeEqualToString("element.setAttributeNode(attr).value", "background-color: red"); |
+// Setting the value must correctly locate attribute on the element and update it, |
+// even if the local name differs. PASS if no crash (crbug.com/376718) |
+shouldBeEqualToString("attr.value = 'background-color: green'; attr.value", "background-color: green"); |
+shouldBeEqualToString("element.getAttribute('style')", "background-color: green"); |
+</script> |
+</body> |
+</html> |