Protect an element while removing an attribute.

LayoutTests/http/tests/misc/adopt-iframe-src-attr-after-remove.html

Index: LayoutTests/http/tests/misc/adopt-iframe-src-attr-after-remove.html
diff --git a/LayoutTests/http/tests/misc/adopt-iframe-src-attr-after-remove.html b/LayoutTests/http/tests/misc/adopt-iframe-src-attr-after-remove.html
new file mode 100644
index 0000000000000000000000000000000000000000..e6f241dcf038859ca993b733edd275b1732bc825
--- /dev/null
+++ b/LayoutTests/http/tests/misc/adopt-iframe-src-attr-after-remove.html
@@ -0,0 +1,22 @@
+We pass if we don't crash under ASAN.

[esprehn, 2014/06/20 20:01:30]

Missing doctype.

+<iframe id=i src="../navigation/resources/blank.txt"></iframe>

[esprehn, 2014/06/20 20:01:31]

Can we use iframe instead of "i"?

+<script>
+if (window.testRunner) {
+    testRunner.dumpAsText();
+    testRunner.waitUntilDone();
+}
+
+window.onload = function()
+{
+    i.parentNode.removeChild(i);

[esprehn, 2014/06/20 20:01:30]

i.remove();

+    gc();
+}
+
+document.addEventListener("DOMContentLoaded", function() {
+    setTimeout(function() {
+        document.adoptNode(i.attributes["src"]);

[esprehn, 2014/06/20 20:01:30]

Just use removeAttribute? I don't know why you're adopting the Attr node like
this.

[Nate Chapin, 2014/06/20 20:17:42]

I was building this off of a clusterfuzz testcase, so I left it minimally
modified. I suspect removeAttribute would suffice.

+        if (window.testRunner)
+            testRunner.notifyDone();
+    }, 0);
+}, false);
+</script>