| OLD | NEW |
|---|
| 1 <!doctype html> |
| 1 <!-- This tests for regression of https://crbug.com/265838 where adjacent, neste
d isolates caused a use-after-free if the elements were later removed. --> | 2 <!-- This tests for regression of https://crbug.com/265838 where adjacent, neste
d isolates caused a use-after-free if the elements were later removed. --> |
| 2 <script> | 3 <script> |
| 3 function remove(node) | |
| 4 { | |
| 5 node.parentNode.removeChild(node); | |
| 6 } | |
| 7 | |
| 8 window.onload = function() | 4 window.onload = function() |
| 9 { | 5 { |
| 10 document.body.offsetTop; | 6 document.body.offsetTop; |
| 11 remove(b.lastChild); | 7 b.lastChild.parentNode.removeChild(b.lastChild); |
| 12 document.body.offsetTop; | 8 document.body.offsetTop; |
| 13 remove(a.firstChild); | 9 a.firstChild.parentNode.removeChild(a.firstChild); |
| 14 document.body.offsetTop; | 10 document.body.offsetTop; |
| 15 | 11 |
| 16 document.body.appendChild(document.createTextNode("PASS did not crash")); | 12 document.write("PASS did not crash"); |
| 17 } | 13 } |
| 18 </script> | 14 </script> |
| 19 | 15 |
| 20 <body> | 16 <body> |
| 21 <div id="a">foo</div> | 17 <div id="a">foo</div> |
| 22 <div></div> | 18 <div></div> |
| 23 <div> | 19 <div> |
| 24 <output> | 20 <output> |
| 25 <output>bar</output> | 21 <output>bar</output> |
| 26 <span id="b"> | 22 <span id="b"> |
| 27 <span><div style="display:inline-block"></div><br><br><br></span> | 23 <span><div style="display:inline-block"></div><br><br><br></span> |
| 28 </span> | 24 </span> |
| 29 </output> | 25 </output> |
| 30 </div> | 26 </div> |
| 31 </body> | 27 </body> |
| 32 | 28 |
| 33 <script> | 29 <script> |
| 34 if (window.testRunner) | 30 if (window.testRunner) |
| 35 testRunner.dumpAsText(); | 31 testRunner.dumpAsText(); |
| 36 </script> | 32 </script> |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 23972003:
Update containtingIsolate to go back all the way to top isolate from current (Closed)
Base URL: https://chromium.googlesource.com/chromium/blink.git@master