1
    2
    3
    4
    5
    6
    7
    8
    9
   10
   11
   12
   13
   14
   15
   16
   17
   18
   19
   20
   21
   22
   23
   24
   25
   26
   27
   28
   29
   30
   31
   32
   33
   34
   35
   36
   37
   38
   39
   40
   41
   42
   43
   44
   45
   46
   47
   48
   49
   50
   51
   52
   53
   54
   55
   56
   57
   58
   59
   60
   61
   62
   63
   64
   65
   66
   67
   68
   69
   70


content / test / data / accessibility / html / delete-selection-crash.html [blame]

<!--
@WAIT-FOR:Done

This is a regression test for a bug that intermittently causes a crash due to a
combination of re-creating a node and setting its parent to an AXNode created
for a continuation LayoutObject.

Since the crash is intermittent, give the (generated) reproduction code 10
chances to reproduce the bug before terminating the test successfully.
-->
<html>
<head>
<style>
#fuzz1 {
 -webkit-shape-outside: url(x);
}
</style>
<script>

function boom() {
  requestAnimationFrame(() => { setTimeout(() => {
    let iteration = Number.parseInt(document.location.hash.substring(1));
    if (isNaN(iteration))
      iteration = 0;

    if (iteration > 10) {
      document.body.innerHTML = "Done";
      // remove hash
      history.pushState("", document.title, window.location.pathname
			+ window.location.search);
      return;
    }
    iteration = iteration + 1;
    location.hash = iteration;
    var fuzz11 = document.getElementById("fuzz11");
    var fuzz16 = document.getElementById("fuzz16");
    var fuzz18 = document.getElementById("fuzz18");

    try { var i5 = document.execCommand("selectAll", false); } catch(e) { }
    try { var i18 = document.getSelection(); } catch(e) { }
    try { i18.extend(fuzz18); } catch(e) { }
    try { var i78 = window.frames; } catch(e) { }
    try { fuzz11.after(fuzz16); } catch(e) { }
    try { var i167 = i78.pageYOffset; } catch(e) { }
    try { i18.deleteFromDocument(); } catch(e) { }
    location.reload(true);
  }); });
}

</script>
</head>
<body onload=boom()>
<marquee id="fuzz2">
<hr id="fuzz4" >
</hr>
</marquee>
<data id="fuzz6"  alt="AAAA"  >
<time id="fuzz1" >
<label id="fuzz11" ></label>
<style id="fuzz12" ></style>
<hr id="fuzz16"  >
<hr id="fuzz17"  >
<dl id="fuzz18"  >
</dl>
</hr>
<span id="fuzz24" style="columns: 0px">
</span>
</hr>
</body>
</html>