7 testRunner
.dumpAsText();
10 Loading this page should not crash.
13 .
<input id=cb
type=
"checkbox">.
16 var sel
= window
.getSelection();
17 var td1
= document
.getElementById('td1')
18 // having selection triggers Document::updateRendering() from paint()
19 sel
.setBaseAndExtent(td1
, 0, td1
, 1000);
20 // this causes style recalc and rendering tree tear down (from updateRendering) in middle of painting, which crashes
21 document
.body
.setAttribute('class','gone');
22 var cb
= document
.getElementById('cb')
23 // this triggers synchronous paint()
25 document
.body
.setAttribute('class','');