third_party/WebKit/LayoutTests/fast/dom/hover-node-refcnt-asan-crash.html

   1 <div id=div0></div>
   2 <div id=div1>
   3   <div id=overflow style="width:500px; height:150px; padding:10px">
   4     <img width=100 height=100>
   5   </div>
   6   <p id=p0>1</p>
   7   <span id=span0></span>
   8 </div>
   9 <p>This test should not crash on ASAN</p>
  10 <script>
  11 // crbug.com/514755, This test crashes on ASAN builds.
  12 // The crash happens while updating the old hovered active nodes chain
  13 // after hovered node changes. Nodes were deref'ed and could be mistakenly freed
  14 // before use.
  15 if (window.testRunner)
  16   window.testRunner.dumpAsText();
  17
  18 eventSender.mouseMoveTo(50, 100);
  19 eventSender.mouseDown(1);
  20 eventSender.mouseMoveTo(50, 200);
  21
  22 div0.addEventListener("DOMNodeRemoved", function () {
  23   // This triggers removing all children in #div1
  24   div1.innerHTML = '';
  25 });
  26
  27 // hovered element (<img>) will disappear.
  28 div1.createShadowRoot();
  29 div0.appendChild(p0);
  30 // This causes synchronous DOMNodeRemoved event
  31 div0.replaceChild(span0, p0);
  32 gc();
  33 </script>