57 lines
1.6 KiB
HTML
57 lines
1.6 KiB
HTML
<html>
|
|
<body>
|
|
<div id="div"></div>
|
|
<p> Test for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=34231">34231</a>: Nodes in XPath result snapshots should keep JS wrappers alive.</p>
|
|
<p>This page tests for proper invalidation of a node's event listeners. If the test passes, you'll see a PASS message below.</p>
|
|
<pre id="console">FAILED: Test did not run.</pre>
|
|
<script>
|
|
function $(id)
|
|
{
|
|
return document.getElementById(id);
|
|
}
|
|
|
|
function log(s)
|
|
{
|
|
$('console').innerHTML = s + '\n';
|
|
}
|
|
|
|
function allocate() {
|
|
for (var i = 0; i < 3000; ++i)
|
|
String(i);
|
|
}
|
|
|
|
(function () {
|
|
if (window.testRunner)
|
|
testRunner.dumpAsText();
|
|
|
|
// Fill the heap with event listeners...
|
|
var a = []
|
|
for (var i = 0; i < 5000; ++i)
|
|
a[a.length] = function() { };
|
|
|
|
// ...followed by a DOM node wrapper
|
|
var div = $("div");
|
|
|
|
// Add the listeners to the DOM node.
|
|
for (var i = 0; i < a.length; ++i)
|
|
div.addEventListener("click", a[i], false);
|
|
|
|
// Eliminate JS references to the div and its listeners, but keep a reference to the div in an XPath query.
|
|
var query = document.evaluate("//div", document.documentElement, null, XPathResult.UNORDERED_NODE_SNAPSHOT_TYPE, null);
|
|
div.parentNode.removeChild(div);
|
|
div = null
|
|
a = null;
|
|
|
|
// Potentially overwrite listeners with strings, but don't overwrite div.
|
|
allocate();
|
|
|
|
// Fire listeners and see if we crash.
|
|
var event = document.createEvent('MouseEvent');
|
|
event.initEvent('click', true, true);
|
|
query.snapshotItem(0).dispatchEvent(event);
|
|
|
|
log("PASS: You didn't crash.");
|
|
})();
|
|
</script>
|
|
</body></html>
|