| Index: LayoutTests/fast/text/international/unicode-bidi-isolate-nested-with-removes.html
|
| diff --git a/LayoutTests/fast/text/international/unicode-bidi-isolate-nested-with-removes.html b/LayoutTests/fast/text/international/unicode-bidi-isolate-nested-with-removes.html
|
| index 8d0213489fb7815c16790c13f397ae38c292091a..23fb022a28b1ae738517c6e24169bd22274a5c1a 100644
|
| --- a/LayoutTests/fast/text/international/unicode-bidi-isolate-nested-with-removes.html
|
| +++ b/LayoutTests/fast/text/international/unicode-bidi-isolate-nested-with-removes.html
|
| @@ -1,19 +1,15 @@
|
| +<!doctype html>
|
| <!-- This tests for regression of https://crbug.com/265838 where adjacent, nested isolates caused a use-after-free if the elements were later removed. -->
|
| <script>
|
| -function remove(node)
|
| -{
|
| - node.parentNode.removeChild(node);
|
| -}
|
| -
|
| window.onload = function()
|
| {
|
| document.body.offsetTop;
|
| - remove(b.lastChild);
|
| + b.lastChild.parentNode.removeChild(b.lastChild);
|
| document.body.offsetTop;
|
| - remove(a.firstChild);
|
| + a.firstChild.parentNode.removeChild(a.firstChild);
|
| document.body.offsetTop;
|
|
|
| - document.body.appendChild(document.createTextNode("PASS did not crash"));
|
| + document.write("PASS did not crash");
|
| }
|
| </script>
|
|
|
|
|
Chromium Code Reviews
Issue 23972003:
Update containtingIsolate to go back all the way to top isolate from current (Closed)
Base URL: https://chromium.googlesource.com/chromium/blink.git@master