Index: LayoutTests/media/remove-from-document-config-controls-no-crash.html |
diff --git a/LayoutTests/media/remove-from-document-config-controls-no-crash.html b/LayoutTests/media/remove-from-document-config-controls-no-crash.html |
new file mode 100644 |
index 0000000000000000000000000000000000000000..c7c78ce37468df961f6cde0d7425759560ecd8e2 |
--- /dev/null |
+++ b/LayoutTests/media/remove-from-document-config-controls-no-crash.html |
@@ -0,0 +1,43 @@ |
+<!DOCTYPE html> |
+<html> |
+<head> |
+<script src="../resources/js-test.js"></script> |
+</head> |
+<body> |
+<video id="v"></video> |
+<script> |
+description("Verify that removing a video element from the DOM does not crash."); |
+ |
+window.jsTestIsAsync = true; |
+ |
+if (window.testRunner) { |
+ testRunner.dumpAsText(); |
+ testRunner.waitUntilDone(); |
+} |
+ |
+function runTest() { |
+ if (!window.internals) { |
+ finishJSTest(); |
+ return; |
+ } |
+ var video = document.getElementById('v'); |
+ var videoShadow = window.internals.shadowRoot(video); |
+ traverse(videoShadow); |
+ |
+ document.body.removeChild(video); |
+ finishJSTest(); |
+} |
+ |
+function traverse(node) { |
+ if (!node) |
+ return; |
+ if (node.attributes) |
+ Array.prototype.forEach.call(node.attributes, function (n) { node[n && n.localName] = 2; }); |
philipj_slow
2015/02/27 10:35:29
This looks a bit cryptic to me. Is this to take co
sof
2015/02/27 10:39:54
It is a reduction from a fuzzer's doing; iterating
philipj_slow
2015/02/27 11:04:33
Does it matter if node.foo is set or if the callba
sof
2015/02/27 11:16:34
It matters, involving node.max in particular..but
|
+ if (node.childNodes) |
+ Array.prototype.forEach.call(node.childNodes, traverse); |
+ if (node.localName == 'input') |
philipj_slow
2015/02/27 10:35:29
Could this not be made unconditional given the nul
sof
2015/02/27 10:39:54
It could, but I don't see the value of making the
philipj_slow
2015/02/27 11:04:33
Very well, it looked to me like it was already try
|
+ traverse(window.internals.shadowRoot(node)); |
+} |
+window.onload = runTest; |
+</script> |
+</html> |