third_party/WebKit/LayoutTests/fast/events/nested-event-remove-node-crash.html

   1 <html>
   2 <head>
   3 <script>
   4 function sendXHR()
   5 {
   6     XHR[numXHRs] = new XMLHttpRequest();
   7     XHR[numXHRs].onreadystatechange = handleStateChange;
   8     XHR[numXHRs].open("GET", "nested-event-remove-node-crash-expected.txt", true);
   9     XHR[numXHRs].send(null);
  10     numXHRs = numXHRs + 1;
  11 }
  12
  13 function callback(response)
  14 {
  15     document.getElementById("replaceMe").innerHTML = "";
  16     document.getElementById("replaceMe").innerHTML = response;
  17     if (window.testRunner && (run == 2))
  18         testRunner.notifyDone();
  19 }
  20
  21 function handleStateChange()
  22 {
  23     if ((XHR[0].readyState == 4) && (run < 2)) { // yes this looks wrong but it's how to reproduce the bug
  24         run = run + 1;
  25         callback(XHR[0].responseText);
  26     }
  27 }
  28
  29 function test()
  30 {
  31 /*
  32     1. focus a node
  33     2. send an XHR who's handler will remove the node
  34     3. the focused node's onblur will fire
  35     4. the onblur event handler will send off an XHR who's handler will remove the node
  36 */
  37     document.getElementById("theSelect").focus();
  38     sendXHR();
  39
  40     if (window.testRunner) {
  41         testRunner.waitUntilDone();
  42         testRunner.dumpAsText();
  43     }
  44 }
  45
  46 function GC()
  47 {
  48     // Force GC.
  49     if (window.GCController)
  50         GCController.collect();
  51     else {
  52         for (var i = 0; i < 10000; ++i) {
  53             ({ });
  54         }
  55     }
  56 }
  57
  58 /* GLOBALS */
  59 var XHR = new Array();
  60 var numXHRs = 0;
  61 var run = 0;
  62
  63 </script>
  64 </head>
  65 <body onload="test()">
  66
  67 <div id="replaceMe">
  68
  69 <div>
  70 <select id="theSelect" onblur="sendXHR();GC();">
  71 </select>
  72 </div>
  73
  74 </div>
  75 </body>
  76 </html>