| OLD | NEW |
|---|
| (Empty) | |
| 1 <!-- This test is to catch a flakey use-after-free for ASAN bots. (see crbug.com
/402407) --> |
| 2 <script> |
| 3 function start() { |
| 4 svgIframe = document.createElement('iframe'); |
| 5 svgIframe.src = 'resources/do-not-crash-use-after-free-update-widget-positio
ns.svg'; |
| 6 |
| 7 bodyElement = document.body; |
| 8 |
| 9 articleElement = document.createElement('article'); |
| 10 acronymElement = document.createElement('acronym'); |
| 11 |
| 12 bodyElement.style.overflow = 'scroll'; |
| 13 |
| 14 selectionRange = document.createRange(); |
| 15 selectionRange.selectNodeContents(articleElement); |
| 16 selectionRange.surroundContents(bodyElement); |
| 17 |
| 18 w3Iframe = document.createElementNS('http://www.w3.org/1999/xhtml', 'iframe'
); |
| 19 w3Iframe.src = 'resources/do-not-crash-use-after-free-update-widget-position
s-iframe.html'; |
| 20 w3Iframe.onload = iframeOnLoad; |
| 21 document.documentElement.appendChild(w3Iframe); |
| 22 |
| 23 selectionRange.insertNode(svgIframe); |
| 24 bodyElement.style.position = 'fixed'; |
| 25 |
| 26 while (svgIframe.parentNode) { |
| 27 svgIframe = svgIframe.parentNode; |
| 28 } |
| 29 |
| 30 svgIframe.createElement; |
| 31 |
| 32 document.documentElement.appendChild(svgIframe); |
| 33 |
| 34 acronymElement.style.position = 'absolute'; |
| 35 } |
| 36 |
| 37 function iframeOnLoad() { |
| 38 bodyElement.appendChild(acronymElement); |
| 39 acronymElement.offsetWidth; |
| 40 |
| 41 acronymElement.appendChild(w3Iframe); |
| 42 w3Iframe.offsetWidth; |
| 43 |
| 44 window.setTimeout('window.iframeCallback()', 50); |
| 45 } |
| 46 |
| 47 function iframeCallback() { |
| 48 bodyElement.style.cssText = null; |
| 49 |
| 50 w3Iframe.contentDocument.location.hash = 'element0'; |
| 51 } |
| 52 |
| 53 if (window.testRunner) { |
| 54 testRunner.dumpAsText(); |
| 55 } |
| 56 </script> |
| 57 <body onload = "start()"> |
| 58 This test passes if it doesn't crash. |
| 59 </body> |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 490473003:
Defer call to updateWidgetPositions() outside of RenderLayerScrollableArea. (Closed)
Base URL: svn://svn.chromium.org/blink/trunk
