Protect an element while removing an attribute.

LayoutTests/http/tests/misc/adopt-iframe-src-attr-after-remove.html

Index: LayoutTests/http/tests/misc/adopt-iframe-src-attr-after-remove.html
diff --git a/LayoutTests/http/tests/misc/adopt-iframe-src-attr-after-remove.html b/LayoutTests/http/tests/misc/adopt-iframe-src-attr-after-remove.html
new file mode 100644
index 0000000000000000000000000000000000000000..e6f241dcf038859ca993b733edd275b1732bc825
--- /dev/null
+++ b/LayoutTests/http/tests/misc/adopt-iframe-src-attr-after-remove.html
@@ -0,0 +1,22 @@
+We pass if we don't crash under ASAN.
+<iframe id=i src="../navigation/resources/blank.txt"></iframe>
+<script>
+if (window.testRunner) {
+    testRunner.dumpAsText();
+    testRunner.waitUntilDone();
+}
+
+window.onload = function()
+{
+    i.parentNode.removeChild(i);
+    gc();
+}
+
+document.addEventListener("DOMContentLoaded", function() {
+    setTimeout(function() {
+        document.adoptNode(i.attributes["src"]);

[esprehn, 2014/06/20 21:24:45]

It abarth explained to me the reason for the adoptNode. The "i" variable is gone
since we've called down into adoptNode to remove the Attr node and for some
reason the Attr is not keeping the owner element alive.

So the two bugs here seem to be:

1) Attr should keep the owner element alive.
2) onload should never fire synchronously.

+        if (window.testRunner)
+            testRunner.notifyDone();
+    }, 0);
+}, false);
+</script>