33 lines
774 B
HTML
33 lines
774 B
HTML
<!doctype html>
|
|
<!-- This tests for regression of https://crbug.com/265838 where adjacent, nested isolates caused a use-after-free if the elements were later removed. -->
|
|
<script>
|
|
window.onload = function()
|
|
{
|
|
document.body.offsetTop;
|
|
b.lastChild.parentNode.removeChild(b.lastChild);
|
|
document.body.offsetTop;
|
|
a.firstChild.parentNode.removeChild(a.firstChild);
|
|
document.body.offsetTop;
|
|
|
|
document.write("PASS did not crash");
|
|
}
|
|
</script>
|
|
|
|
<body>
|
|
<div id="a">foo</div>
|
|
<div></div>
|
|
<div>
|
|
<output>
|
|
<output>bar</output>
|
|
<span id="b">
|
|
<span><div style="display:inline-block"></div><br><br><br></span>
|
|
</span>
|
|
</output>
|
|
</div>
|
|
</body>
|
|
|
|
<script>
|
|
if (window.testRunner)
|
|
testRunner.dumpAsText();
|
|
</script>
|