third_party/WebKit/LayoutTests/fast/dom/gc-treescope.html

   1 <!DOCTYPE html>
   2 <html>
   3 <body>
   4 <div>Test passes if it does not crash.</div>
   5 <script>
   6 if (window.testRunner) {
   7     testRunner.dumpAsText();
   8     testRunner.waitUntilDone();
   9 }
  10
  11 function reloadUntil(max) {
  12    var index = window.location.href.indexOf("?");
  13     if (index == -1) {
  14         window.location.href = window.location.href + "?1";
  15     } else {
  16         var num = parseInt(window.location.href.substring(index + 1));
  17         if (num == max) {
  18             if (window.testRunner)
  19                 testRunner.notifyDone();
  20         } else {
  21             window.location.href = window.location.href.substring(0, index + 1) + (num + 1);
  22         }
  23     }
  24 }
  25
  26 function init() {
  27     var shadowHost = document.createElement("SHADOWHOST");
  28     var shadowRoot = shadowHost.createShadowRoot();
  29     var child = document.createElement("CHILD");
  30     shadowRoot.appendChild(child);
  31     child.style.zoom = 34;
  32     var styleAttr = child.attributes[0];
  33     child.removeAttribute("style");
  34     shadowHost.appendChild(shadowRoot);
  35
  36     // The crash (use-after-free) is flaky. We have to reload the page a number of times to reproduce the crash.
  37     // I couldn't find a reliable way to reproduce, such as using gc(), adjusting the scopes of variables and so on.
  38     // As of now, we can hit a crash by reloading about 50 times.
  39     reloadUntil(80);
  40 }
  41
  42 document.addEventListener("DOMContentLoaded", init, false);
  43 </script>
  44 </body>
  45 </html>