Chromium Code Reviews| Index: LayoutTests/media/remove-from-document-config-controls-no-crash.html |
| diff --git a/LayoutTests/media/remove-from-document-config-controls-no-crash.html b/LayoutTests/media/remove-from-document-config-controls-no-crash.html |
| new file mode 100644 |
| index 0000000000000000000000000000000000000000..c7c78ce37468df961f6cde0d7425759560ecd8e2 |
| --- /dev/null |
| +++ b/LayoutTests/media/remove-from-document-config-controls-no-crash.html |
| @@ -0,0 +1,43 @@ |
| +<!DOCTYPE html> |
| +<html> |
| +<head> |
| +<script src="../resources/js-test.js"></script> |
| +</head> |
| +<body> |
| +<video id="v"></video> |
| +<script> |
| +description("Verify that removing a video element from the DOM does not crash."); |
| + |
| +window.jsTestIsAsync = true; |
| + |
| +if (window.testRunner) { |
| + testRunner.dumpAsText(); |
| + testRunner.waitUntilDone(); |
| +} |
| + |
| +function runTest() { |
| + if (!window.internals) { |
| + finishJSTest(); |
| + return; |
| + } |
| + var video = document.getElementById('v'); |
| + var videoShadow = window.internals.shadowRoot(video); |
| + traverse(videoShadow); |
| + |
| + document.body.removeChild(video); |
| + finishJSTest(); |
| +} |
| + |
| +function traverse(node) { |
| + if (!node) |
| + return; |
| + if (node.attributes) |
| + Array.prototype.forEach.call(node.attributes, function (n) { node[n && n.localName] = 2; }); |
|
philipj_slow
2015/02/27 10:35:29
This looks a bit cryptic to me. Is this to take co
sof
2015/02/27 10:39:54
It is a reduction from a fuzzer's doing; iterating
philipj_slow
2015/02/27 11:04:33
Does it matter if node.foo is set or if the callba
sof
2015/02/27 11:16:34
It matters, involving node.max in particular..but
|
| + if (node.childNodes) |
| + Array.prototype.forEach.call(node.childNodes, traverse); |
| + if (node.localName == 'input') |
|
philipj_slow
2015/02/27 10:35:29
Could this not be made unconditional given the nul
sof
2015/02/27 10:39:54
It could, but I don't see the value of making the
philipj_slow
2015/02/27 11:04:33
Very well, it looked to me like it was already try
|
| + traverse(window.internals.shadowRoot(node)); |
| +} |
| +window.onload = runTest; |
| +</script> |
| +</html> |