third_party/WebKit/LayoutTests/fast/css/button-inner-child-crash.html

   1 <!DOCTYPE html>
   2 <style>
   3 html, body, button { all: inherit; }
   4 .resizer::-webkit-resizer { text-anchor: end; }
   5 .resize { resize: horizontal; }
   6 </style>
   7
   8 <script>
   9 if (window.testRunner)
  10   testRunner.dumpAsText();
  11
  12 function crash() {
  13   outer_button.addEventListener("DOMNodeRemoved", function () {
  14     outer_button.removeAttribute("class");
  15   }, false);
  16
  17   outer_button.appendChild(inner_button);
  18   outer_button.classList.toggle("resizer");
  19   outer_button.classList.add("resize");
  20
  21   window.scrollBy(54, 49);
  22   inner_button.style.display = "table-row-group"
  23
  24   var svg = document.implementation.createDocument("http://www.w3.org/2000/svg", "svg", null);
  25   svg.documentElement.appendChild(input);
  26
  27   window.scrollBy(11, 81);
  28
  29   inner_button.parentNode.removeChild(inner_button);
  30 }
  31 document.addEventListener("DOMContentLoaded", crash, false);
  32 </script>
  33
  34 <button id='outer_button'>
  35   Test passes if it does not crash.
  36   <input id='input'>
  37     <button id='inner_button'></button>
  38   </input>
  39 </button>