| OLD | NEW |
|---|
| (Empty) | |
| 1 <!DOCTYPE html> |
| 2 <!-- This test is to catch a flakey use-after-free for ASAN bots. (see crbug.com
/402407) --> |
| 3 <script> |
| 4 function start() { |
| 5 svgIframe = document.createElement('iframe'); |
| 6 svgIframe.src = 'resources/do-not-crash-use-after-free-update-widget-positio
ns.svg'; |
| 7 |
| 8 bodyElement = document.body; |
| 9 |
| 10 articleElement = document.createElement('article'); |
| 11 acronymElement = document.createElement('acronym'); |
| 12 |
| 13 bodyElement.style.overflow = 'scroll'; |
| 14 |
| 15 selectionRange = document.createRange(); |
| 16 selectionRange.selectNodeContents(articleElement); |
| 17 selectionRange.surroundContents(bodyElement); |
| 18 |
| 19 w3Iframe = document.createElementNS('http://www.w3.org/1999/xhtml', 'iframe'
); |
| 20 w3Iframe.src = 'resources/do-not-crash-use-after-free-update-widget-position
s-iframe.html'; |
| 21 w3Iframe.onload = iframeOnLoad; |
| 22 document.documentElement.appendChild(w3Iframe); |
| 23 |
| 24 selectionRange.insertNode(svgIframe); |
| 25 bodyElement.style.position = 'fixed'; |
| 26 |
| 27 while (svgIframe.parentNode) { |
| 28 svgIframe = svgIframe.parentNode; |
| 29 } |
| 30 |
| 31 svgIframe.createElement; |
| 32 |
| 33 document.documentElement.appendChild(svgIframe); |
| 34 |
| 35 acronymElement.style.position = 'absolute'; |
| 36 } |
| 37 |
| 38 function iframeOnLoad() { |
| 39 bodyElement.appendChild(acronymElement); |
| 40 acronymElement.offsetWidth; |
| 41 |
| 42 acronymElement.appendChild(w3Iframe); |
| 43 w3Iframe.offsetWidth; |
| 44 |
| 45 window.setTimeout('window.iframeCallback()', 50); |
| 46 } |
| 47 |
| 48 function iframeCallback() { |
| 49 bodyElement.style.cssText = null; |
| 50 |
| 51 w3Iframe.contentDocument.location.hash = 'element0'; |
| 52 } |
| 53 |
| 54 if (window.testRunner) { |
| 55 testRunner.dumpAsText(); |
| 56 } |
| 57 </script> |
| 58 <body onload = "start()"> |
| 59 This test passes if it doesn't crash. |
| 60 </body> |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 490473003:
Defer call to updateWidgetPositions() outside of RenderLayerScrollableArea. (Closed)
Base URL: svn://svn.chromium.org/blink/trunk