third_party/WebKit/LayoutTests/fast/text/international/unicode-bidi-isolate-nested-with-removes.html

   1 <!doctype html>
   2 <!-- This tests for regression of https://crbug.com/265838 where adjacent, nested isolates caused a use-after-free if the elements were later removed. -->
   3 <script>
   4 window.onload = function()
   5 {
   6     document.body.offsetTop;
   7     b.lastChild.parentNode.removeChild(b.lastChild);
   8     document.body.offsetTop;
   9     a.firstChild.parentNode.removeChild(a.firstChild);
  10     document.body.offsetTop;
  11
  12     document.write("PASS did not crash");
  13 }
  14 </script>
  15
  16 <body>
  17   <div id="a">foo</div>
  18   <div></div>
  19   <div>
  20     <output>
  21         <output>bar</output>
  22         <span id="b">
  23             <span><div style="display:inline-block"></div><br><br><br></span>
  24         </span>
  25     </output>
  26   </div>
  27 </body>
  28
  29 <script>
  30 if (window.testRunner)
  31     testRunner.dumpAsText();
  32 </script>