25 lines
951 B
HTML
25 lines
951 B
HTML
<!DOCTYPE html>
|
|
<div>Tests for a crash due to modifying the DOM during mutation events due to an adoptNode call. If this page doesn't crash and DOMSubtreeModified is fire, this test succeeds.</div>
|
|
<div id="result"></div>
|
|
<div id="node-to-adopt"></div>
|
|
<iframe></iframe>
|
|
<script>
|
|
if (window.testRunner)
|
|
testRunner.dumpAsText();
|
|
|
|
var nodeToAdopt = document.getElementById('node-to-adopt');
|
|
|
|
var mutationHandler = function() {
|
|
document.body.removeEventListener('DOMSubtreeModified', mutationHandler, true);
|
|
document.getElementById('result').innerHTML = "DOMSubtreeModified fired";
|
|
document.body.appendChild(nodeToAdopt);
|
|
};
|
|
document.body.addEventListener('DOMSubtreeModified', mutationHandler, true);
|
|
|
|
var iframe = document.querySelector('iframe');
|
|
var iframeDoc = iframe.contentDocument;
|
|
iframeDoc.adoptNode(nodeToAdopt);
|
|
// The crash happens when the iframe's document is getting detached.
|
|
document.body.removeChild(iframe);
|
|
</script>
|