third_party/WebKit/LayoutTests/fast/text/international/unicode-bidi-isolate-nested-with-removes-not-adjacent.html

   1 <!doctype html>
   2 <!-- This tests for regression of https://crbug.com/279277 where non-adjacent, nested isolates caused a use-after-free if the elements were later removed. -->
   3 <script>
   4 window.onload = function() {
   5   document.body.offsetTop;
   6   b.lastChild.parentNode.removeChild(b.lastChild);
   7   document.body.offsetTop;
   8   a.nextSibling.parentNode.removeChild(a.nextSibling);
   9   document.body.offsetTop;
  10
  11   document.write("PASS did not crash");
  12 }
  13 </script>
  14
  15 <body>
  16   <div id="a">foo</div><div>baz</div><div></div>
  17   <div>
  18     <output>
  19       <span>
  20         <output>bar</output>
  21         <span id="b">
  22           <span>
  23             <div style="display:inline-block"></div>
  24             <br><br>
  25           </span>
  26         </span>
  27       </span>
  28     </output>
  29   </div>
  30 </body>
  31
  32 <script>
  33 if (window.testRunner)
  34     testRunner.dumpAsText();
  35 </script>