third_party/WebKit/LayoutTests/fast/dynamic/checkbox-selection-crash.html

   1 <head>
   2 <style>
   3 .gone { display:none }
   4 </style>
   5 <script>
   6 if (window.testRunner)
   7     testRunner.dumpAsText();
   8 </script>
   9 <body>
  10 Loading this page should not crash.
  11 <table>
  12 <td id=td1>
  13 .<input id=cb type="checkbox">.
  14 </table>
  15 <script>
  16     var sel = window.getSelection();
  17     var td1 = document.getElementById('td1')
  18     // having selection triggers Document::updateRendering() from paint()
  19     sel.setBaseAndExtent(td1, 0, td1, 1000);
  20     // this causes style recalc and rendering tree tear down (from updateRendering) in middle of painting, which crashes
  21     document.body.setAttribute('class','gone');
  22     var cb = document.getElementById('cb')
  23     // this triggers synchronous paint()
  24     cb.click();
  25     document.body.setAttribute('class','');
  26 </script>
  27 </body>
  28