36 lines
837 B
HTML
36 lines
837 B
HTML
<!doctype html>
|
|
<!-- This tests for regression of https://crbug.com/279277 where non-adjacent, nested isolates caused a use-after-free if the elements were later removed. -->
|
|
<script>
|
|
window.onload = function() {
|
|
document.body.offsetTop;
|
|
b.lastChild.parentNode.removeChild(b.lastChild);
|
|
document.body.offsetTop;
|
|
a.nextSibling.parentNode.removeChild(a.nextSibling);
|
|
document.body.offsetTop;
|
|
|
|
document.write("PASS did not crash");
|
|
}
|
|
</script>
|
|
|
|
<body>
|
|
<div id="a">foo</div><div>baz</div><div></div>
|
|
<div>
|
|
<output>
|
|
<span>
|
|
<output>bar</output>
|
|
<span id="b">
|
|
<span>
|
|
<div style="display:inline-block"></div>
|
|
<br><br>
|
|
</span>
|
|
</span>
|
|
</span>
|
|
</output>
|
|
</div>
|
|
</body>
|
|
|
|
<script>
|
|
if (window.testRunner)
|
|
testRunner.dumpAsText();
|
|
</script>
|