| Index: LayoutTests/fast/text/international/unicode-bidi-isolate-nested-with-removes.html
|
| diff --git a/LayoutTests/fast/text/international/unicode-bidi-isolate-nested-with-removes.html b/LayoutTests/fast/text/international/unicode-bidi-isolate-nested-with-removes.html
|
| new file mode 100644
|
| index 0000000000000000000000000000000000000000..8d0213489fb7815c16790c13f397ae38c292091a
|
| --- /dev/null
|
| +++ b/LayoutTests/fast/text/international/unicode-bidi-isolate-nested-with-removes.html
|
| @@ -0,0 +1,36 @@
|
| +<!-- This tests for regression of https://crbug.com/265838 where adjacent, nested isolates caused a use-after-free if the elements were later removed. -->
|
| +<script>
|
| +function remove(node)
|
| +{
|
| + node.parentNode.removeChild(node);
|
| +}
|
| +
|
| +window.onload = function()
|
| +{
|
| + document.body.offsetTop;
|
| + remove(b.lastChild);
|
| + document.body.offsetTop;
|
| + remove(a.firstChild);
|
| + document.body.offsetTop;
|
| +
|
| + document.body.appendChild(document.createTextNode("PASS did not crash"));
|
| +}
|
| +</script>
|
| +
|
| +<body>
|
| + <div id="a">foo</div>
|
| + <div></div>
|
| + <div>
|
| + <output>
|
| + <output>bar</output>
|
| + <span id="b">
|
| + <span><div style="display:inline-block"></div><br><br><br></span>
|
| + </span>
|
| + </output>
|
| + </div>
|
| +</body>
|
| +
|
| +<script>
|
| +if (window.testRunner)
|
| + testRunner.dumpAsText();
|
| +</script>
|
|
|
Chromium Code Reviews
Issue 23137012:
Added LayoutTest for use-after-free regression with bidi isolates. (Closed)
Base URL: https://chromium.googlesource.com/chromium/blink.git@master