| Index: LayoutTests/accessibility/adopt-node-causes-crash.html
|
| diff --git a/LayoutTests/accessibility/adopt-node-causes-crash.html b/LayoutTests/accessibility/adopt-node-causes-crash.html
|
| new file mode 100644
|
| index 0000000000000000000000000000000000000000..f052b04293e804cb7259fe2fd16f1200d48d7a07
|
| --- /dev/null
|
| +++ b/LayoutTests/accessibility/adopt-node-causes-crash.html
|
| @@ -0,0 +1,19 @@
|
| +<!DOCTYPE html>
|
| +<script src="../resources/js-test.js"></script>
|
| +
|
| +<!-- Nodes inside a canvas get an AXNodeObject, not an AXRenderObject. -->
|
| +<canvas>
|
| + <div id=node2></div>
|
| +</canvas>
|
| +
|
| +<script>
|
| + description("Ensure that if we have an AXNodeObject with a raw pointer to a Node, the accessible object gets correctly detached if we adopt the node into a new document.");
|
| +
|
| + // This triggers an asynchronous accessibility notification.
|
| + document.getElementById("node2").setAttribute("aria-label", "Label");
|
| +
|
| + // Adopt the node into a new document, then garbage-collect it.
|
| + // Make sure the notification doesn't try to access the invalid node.
|
| + document.implementation.createDocument("", null).adoptNode(node2);
|
| + gc();
|
| +</script>
|
|
|