Chromium Code Reviews Chromium Code Reviews
Issue 332173003:
Update owner document of Range objects if start/end boundary points in different document (Closed)
Base URL: https://chromium.googlesource.com/chromium/blink.git@master| Index: LayoutTests/fast/dom/Range/range-extract-contents-after-move-to-another-document-crash.html |
| diff --git a/LayoutTests/fast/dom/Range/range-extract-contents-after-move-to-another-document-crash.html b/LayoutTests/fast/dom/Range/range-extract-contents-after-move-to-another-document-crash.html |
| new file mode 100644 |
| index 0000000000000000000000000000000000000000..e35dc78499c02061cf8eb0a838ac183c057f2961 |
| --- /dev/null |
| +++ b/LayoutTests/fast/dom/Range/range-extract-contents-after-move-to-another-document-crash.html |
| @@ -0,0 +1,31 @@ |
| +<!DOCTYPE html> |
| +<html> |
| +<head> |
| +<script> |
| +if (window.testRunner) |
| + testRunner.dumpAsText(); |
| + |
| +onload = function() { |
| + var target = document.getElementById('target'); |
| + var child1 = document.getElementById('c1'); |
| + var child2 = document.getElementById('c2'); |
| + var child3 = document.getElementById('c3'); |
| + document.body.removeChild(target); |
| + var range = document.createRange(); |
| + range.selectNode(child2) |
| + target.removeChild(child3); |
|
Yuta Kitamura
2014/06/18 07:48:27
Is this line necessary?
yosin_UTC9
2014/06/18 08:55:40
Yes, this |target.removeChild| invalidates offset
|
| + var anotherDocument = document.implementation.createDocument('', null); |
| + anotherDocument.appendChild(target); |
| + target.appendChild(child1); |
|
Yuta Kitamura
2014/06/18 07:48:27
Is this line necessary?
yosin_UTC9
2014/06/18 08:55:40
Yes, this |target.appendChild()| invokes Range bou
|
| + |
| + range.extractContents(); |
| + document.body.textContent = 'PASS if Blink doesn\'t crash.'; |
| +}; |
| +</script> |
| +</head> |
| +<body> |
| +<span id="target"> |
| +<b id="c1"></b><div id="c2"></div><input id="c3"> |
| +</span> |
| +</body> |
| +</html> |
