third_party/WebKit/LayoutTests/fast/dom/node-iterator-reference-node-moved-crash.html

   1 <html>
   2     <head>
   3         <script>
   4             if (window.testRunner) {
   5                 testRunner.dumpAsText();
   6                 testRunner.waitUntilDone();
   7             }
   8
   9             function gc()
  10             {
  11                 if (window.GCController)
  12                     return GCController.collect();
  13
  14                 for (var i = 0; i < 10000; i++) { // force garbage collection (FF requires about 9K allocations before a collect).
  15                     var s = new String("abc");
  16                 }
  17             }
  18
  19             function runTest()
  20             {
  21                 iteratorRoot = document.createElement('div');
  22                 element = iteratorRoot.appendChild(document.createElement('div'));
  23                 element.appendChild(document.createElement('div'));
  24
  25                 iterator = document.createNodeIterator(iteratorRoot, -1);
  26                 iterator.nextNode(); iterator.nextNode(); iterator.nextNode();
  27                 iterator.previousNode();
  28
  29                 iteratorRoot.removeChild(element);
  30
  31                 otherDocument = document.implementation.createHTMLDocument();
  32                 otherDocument.body.appendChild(iteratorRoot);
  33
  34                 delete iterator;
  35                 gc();
  36                 div = document.body.appendChild(document.createElement('div'));
  37                 document.body.removeChild(div);
  38                 gc();
  39
  40                 if (window.testRunner)
  41                     testRunner.notifyDone();
  42             }
  43         </script>
  44     </head>
  45     <body onload="runTest()">
  46         Test passes if it does not crash.
  47     </body>
  48 </html>