Index: LayoutTests/accessibility/adopt-node-causes-crash.html |
diff --git a/LayoutTests/accessibility/adopt-node-causes-crash.html b/LayoutTests/accessibility/adopt-node-causes-crash.html |
new file mode 100644 |
index 0000000000000000000000000000000000000000..f052b04293e804cb7259fe2fd16f1200d48d7a07 |
--- /dev/null |
+++ b/LayoutTests/accessibility/adopt-node-causes-crash.html |
@@ -0,0 +1,19 @@ |
+<!DOCTYPE html> |
+<script src="../resources/js-test.js"></script> |
+ |
+<!-- Nodes inside a canvas get an AXNodeObject, not an AXRenderObject. --> |
+<canvas> |
+ <div id=node2></div> |
+</canvas> |
+ |
+<script> |
+ description("Ensure that if we have an AXNodeObject with a raw pointer to a Node, the accessible object gets correctly detached if we adopt the node into a new document."); |
+ |
+ // This triggers an asynchronous accessibility notification. |
+ document.getElementById("node2").setAttribute("aria-label", "Label"); |
+ |
+ // Adopt the node into a new document, then garbage-collect it. |
+ // Make sure the notification doesn't try to access the invalid node. |
+ document.implementation.createDocument("", null).adoptNode(node2); |
+ gc(); |
+</script> |