Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(68)

Unified Diff: LayoutTests/svg/dom/SVGTransformTearOff-contextElement-crash.html

Issue 64683006: [svg] TearOffs dynamically hold on to the current contextElement(). (Closed) Base URL: svn://svn.chromium.org/blink/trunk
Patch Set: Created 7 years, 1 month ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: LayoutTests/svg/dom/SVGTransformTearOff-contextElement-crash.html
diff --git a/LayoutTests/svg/dom/SVGTransformTearOff-contextElement-crash.html b/LayoutTests/svg/dom/SVGTransformTearOff-contextElement-crash.html
new file mode 100644
index 0000000000000000000000000000000000000000..7467c2c3d52cb00e64ff27120995af446ff3d22b
--- /dev/null
+++ b/LayoutTests/svg/dom/SVGTransformTearOff-contextElement-crash.html
@@ -0,0 +1,22 @@
+<html>
+<head>
+<script src="../../resources/js-test.js"></script>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+function go() {
+ var svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+ var rect = document.createElementNS("http://www.w3.org/2000/svg", "rect");
+ rect.transform.baseVal.appendItem(svg.createSVGTransform());
+ var transform = rect.transform.baseVal.getItem(0);
+ rect = null;
+ gc();
+ console.log(transform.angle);
+}
+</script>
+</head>
+<body onload="go()">
+This test passes if it doesn't crash.
+</body>
+</html>

Powered by Google App Engine
This is Rietveld 408576698