third_party/WebKit/LayoutTests/accessibility/adopt-node-causes-crash.html

   1 <!DOCTYPE html>
   2 <script src="../resources/js-test.js"></script>
   3
   4 <!-- Nodes inside a canvas get an AXNodeObject, not an AXLayoutObject. -->
   5 <canvas>
   6     <div id=node2></div>
   7 </canvas>
   8
   9 <script>
  10     description("Ensure that if we have an AXNodeObject with a raw pointer to a Node, the accessible object gets correctly detached if we adopt the node into a new document.");
  11
  12     // This triggers an asynchronous accessibility notification.
  13     document.getElementById("node2").setAttribute("aria-label", "Label");
  14
  15     // Adopt the node into a new document, then garbage-collect it.
  16     // Make sure the notification doesn't try to access the invalid node.
  17     document.implementation.createDocument("", null).adoptNode(node2);
  18     gc();
  19 </script>