third_party/WebKit/LayoutTests/fast/dom/NodeList/5725058-crash-scenario-2.html

   1 <p>Test for (rdar://problem/5725058). If you see this text, then all is well and no crash has occurred.</p>
   2
   3 <p id="a">paragraph a</p>
   4 <p id="b">paragraph b</p>
   5 <script>
   6 if (window.testRunner)
   7     testRunner.dumpAsText();
   8
   9 function triggerGarbageCollection()
  10 {
  11     if (window.GCController) {
  12         GCController.collect();
  13         return;
  14     }
  15     for (var i = 0; i < 10000; ++i)
  16         ({})
  17 }
  18
  19 function setUp()
  20 {
  21     // This only works if in a function. I'm not sure why.
  22
  23     // Get node and length from paragraph A into the cache.
  24     document.getElementById("a").childNodes[0];
  25     document.getElementById("a").childNodes.length;
  26 }
  27
  28 setUp();
  29
  30 // Get back to "zero node lists".
  31 triggerGarbageCollection();
  32
  33 // Remove the child node of paragraph A. Use innerHTML to avoid getting a reference to the node being removed.
  34 document.getElementById("a").innerHTML = "";
  35
  36 // Get back to "one node list".
  37 var childNodesB = document.getElementById("b").childNodes;
  38
  39 // Now try the original list.
  40 var x = document.getElementById("a").childNodes[0];
  41 x = document.getElementById("a").childNodes.length;
  42 </script>