| Index: LayoutTests/compositing/overflow/do-not-crash-use-after-free-update-widget-positions.html
|
| diff --git a/LayoutTests/compositing/overflow/do-not-crash-use-after-free-update-widget-positions.html b/LayoutTests/compositing/overflow/do-not-crash-use-after-free-update-widget-positions.html
|
| new file mode 100644
|
| index 0000000000000000000000000000000000000000..8f4d71cc76ae3093b28ae3f6a6171df7c1f37863
|
| --- /dev/null
|
| +++ b/LayoutTests/compositing/overflow/do-not-crash-use-after-free-update-widget-positions.html
|
| @@ -0,0 +1,60 @@
|
| +<!DOCTYPE html>
|
| +<!-- This test is to catch a flakey use-after-free for ASAN bots. (see crbug.com/402407) -->
|
| +<script>
|
| + function start() {
|
| + svgIframe = document.createElement('iframe');
|
| + svgIframe.src = 'resources/do-not-crash-use-after-free-update-widget-positions.svg';
|
| +
|
| + bodyElement = document.body;
|
| +
|
| + articleElement = document.createElement('article');
|
| + acronymElement = document.createElement('acronym');
|
| +
|
| + bodyElement.style.overflow = 'scroll';
|
| +
|
| + selectionRange = document.createRange();
|
| + selectionRange.selectNodeContents(articleElement);
|
| + selectionRange.surroundContents(bodyElement);
|
| +
|
| + w3Iframe = document.createElementNS('http://www.w3.org/1999/xhtml', 'iframe');
|
| + w3Iframe.src = 'resources/do-not-crash-use-after-free-update-widget-positions-iframe.html';
|
| + w3Iframe.onload = iframeOnLoad;
|
| + document.documentElement.appendChild(w3Iframe);
|
| +
|
| + selectionRange.insertNode(svgIframe);
|
| + bodyElement.style.position = 'fixed';
|
| +
|
| + while (svgIframe.parentNode) {
|
| + svgIframe = svgIframe.parentNode;
|
| + }
|
| +
|
| + svgIframe.createElement;
|
| +
|
| + document.documentElement.appendChild(svgIframe);
|
| +
|
| + acronymElement.style.position = 'absolute';
|
| + }
|
| +
|
| + function iframeOnLoad() {
|
| + bodyElement.appendChild(acronymElement);
|
| + acronymElement.offsetWidth;
|
| +
|
| + acronymElement.appendChild(w3Iframe);
|
| + w3Iframe.offsetWidth;
|
| +
|
| + window.setTimeout('window.iframeCallback()', 50);
|
| + }
|
| +
|
| + function iframeCallback() {
|
| + bodyElement.style.cssText = null;
|
| +
|
| + w3Iframe.contentDocument.location.hash = 'element0';
|
| + }
|
| +
|
| + if (window.testRunner) {
|
| + testRunner.dumpAsText();
|
| + }
|
| +</script>
|
| +<body onload = "start()">
|
| + This test passes if it doesn't crash.
|
| +</body>
|
|
|
Chromium Code Reviews
Issue 490473003:
Defer call to updateWidgetPositions() outside of RenderLayerScrollableArea. (Closed)
Base URL: svn://svn.chromium.org/blink/trunk