| Index: LayoutTests/fast/text/international/unicode-bidi-isolate-nested-with-removes-not-adjacent.html
|
| diff --git a/LayoutTests/fast/text/international/unicode-bidi-isolate-nested-with-removes-not-adjacent.html b/LayoutTests/fast/text/international/unicode-bidi-isolate-nested-with-removes-not-adjacent.html
|
| new file mode 100644
|
| index 0000000000000000000000000000000000000000..00020834ce20b3899e28fb9cbe709b1b87745533
|
| --- /dev/null
|
| +++ b/LayoutTests/fast/text/international/unicode-bidi-isolate-nested-with-removes-not-adjacent.html
|
| @@ -0,0 +1,35 @@
|
| +<!doctype html>
|
| +<!-- This tests for regression of https://crbug.com/279277 where non-adjacent, nested isolates caused a use-after-free if the elements were later removed. -->
|
| +<script>
|
| +window.onload = function() {
|
| + document.body.offsetTop;
|
| + b.lastChild.parentNode.removeChild(b.lastChild);
|
| + document.body.offsetTop;
|
| + a.nextSibling.parentNode.removeChild(a.nextSibling);
|
| + document.body.offsetTop;
|
| +
|
| + document.write("PASS did not crash");
|
| +}
|
| +</script>
|
| +
|
| +<body>
|
| + <div id="a">foo</div><div>baz</div><div></div>
|
| + <div>
|
| + <output>
|
| + <span>
|
| + <output>bar</output>
|
| + <span id="b">
|
| + <span>
|
| + <div style="display:inline-block"></div>
|
| + <br><br>
|
| + </span>
|
| + </span>
|
| + </span>
|
| + </output>
|
| + </div>
|
| +</body>
|
| +
|
| +<script>
|
| +if (window.testRunner)
|
| + testRunner.dumpAsText();
|
| +</script>
|
|
|
Chromium Code Reviews
Issue 23972003:
Update containtingIsolate to go back all the way to top isolate from current (Closed)
Base URL: https://chromium.googlesource.com/chromium/blink.git@master