29 lines
786 B
HTML
29 lines
786 B
HTML
<head>
|
|
<style>
|
|
.gone { display:none }
|
|
</style>
|
|
<script>
|
|
if (window.testRunner)
|
|
testRunner.dumpAsText();
|
|
</script>
|
|
<body>
|
|
Loading this page should not crash.
|
|
<table>
|
|
<td id=td1>
|
|
.<input id=cb type="checkbox">.
|
|
</table>
|
|
<script>
|
|
var sel = window.getSelection();
|
|
var td1 = document.getElementById('td1')
|
|
// having selection triggers Document::updateRendering() from paint()
|
|
sel.setBaseAndExtent(td1, 0, td1, td1.childNodes.length);
|
|
// this causes style recalc and rendering tree tear down (from updateRendering) in middle of painting, which crashes
|
|
document.body.setAttribute('class','gone');
|
|
var cb = document.getElementById('cb')
|
|
// this triggers synchronous paint()
|
|
cb.click();
|
|
document.body.setAttribute('class','');
|
|
</script>
|
|
</body>
|
|
|