third_party/WebKit/LayoutTests/fast/dom/custom/upgrade-candidate-adopt-crash.html

   1 <!DOCTYPE html>
   2 <script src="../../../resources/js-test.js"></script>
   3 <script src="testutils.js"></script>
   4 <body>
   5 <script>
   6 description('Tests that an element is not upgraded after being moved to ' +
   7             'a different document, then destroyed');
   8
   9 jsTestIsAsync = true;
  10
  11 withFrame(function (frame) {
  12     // Create an upgrade candidate. Don't wrap it.
  13     var div = document.createElement('div');
  14     div.innerHTML = '<span is="x-a"></span>';
  15
  16     // Move the upgrade candidate to a different document.
  17     frame.contentDocument.body.appendChild(div);
  18
  19     // Delete the upgrade candidate.
  20     div.innerHTML = '';
  21
  22     // Provide a definition that would have matched.
  23     var proto = Object.create(HTMLSpanElement.prototype);
  24     proto.createdCallback = function () {
  25         testFailed('unreachable');
  26     };
  27     document.registerElement('x-a', {prototype: proto});
  28
  29     testPassed('Did not crash.');
  30
  31     frame.remove();
  32     finishJSTest();
  33 });
  34
  35 successfullyParsed = true;
  36 </script>