blob: 45ae70df157ea73019a2b13b6a770bb29c74cde6 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
|
<head>
<style>
.gone { display:none }
</style>
<script>
if (window.testRunner)
testRunner.dumpAsText();
</script>
<body>
Loading this page should not crash.
<table>
<td id=td1>
.<input id=cb type="checkbox">.
</table>
<script>
var sel = window.getSelection();
var td1 = document.getElementById('td1')
// having selection triggers Document::updateRendering() from paint()
sel.setBaseAndExtent(td1, 0, td1, 1000);
// this causes style recalc and rendering tree tear down (from updateRendering) in middle of painting, which crashes
document.body.setAttribute('class','gone');
var cb = document.getElementById('cb')
// this triggers synchronous paint()
cb.click();
document.body.setAttribute('class','');
</script>
</body>
|
