third_party/WebKit/LayoutTests/fast/forms/change-form-element-document-crash.html

   1 <html>
   2 <head>
   3 <script>
   4 if (window.testRunner)
   5     testRunner.dumpAsText();
   6
   7 function gc() {
   8     if (window.GCController)
   9         return GCController.collect();
  10
  11     for (var i = 0; i < 10000; i++)
  12         var s = new String("abc");
  13 }
  14
  15 function crash_test(element_name) {
  16     var element = document.createElement(element_name);
  17     element.setAttribute('form', '1');
  18     var container = document.createElement('div');
  19     container.appendChild(element);
  20     document.implementation.createDocument(null, '').adoptNode(container);
  21     container.removeChild(element);
  22     delete element;
  23     gc();
  24     var form = document.createElement('form');
  25     form.setAttribute('id', '2');
  26     document.body.appendChild(form)
  27 }
  28
  29 function test() {
  30     crash_test('input');
  31     crash_test('object');
  32     document.body.innerHTML += "PASS";
  33 }
  34 </script>
  35 </head>
  36 <body onload="test()">
  37 <p>
  38 This page is a test case for <a href="https://bugs.webkit.org/show_bug.cgi?id=51418">Bug 51418</a>. WebKit should not crash when this page is loaded.
  39 </p>
  40 </body>
  41 </html>