Sharon Yang
f3dddf6be3
Automatic update from web-platform-tests Migrate dom/transforms/css/html crashtests to WPT The following tests were migrated to external/wpt. This includes 12 tests: - external/wpt/css/css-motion-path/crashtests/rotation-overflow.html - external/wpt/css/css-transforms/crashtests/transform-origin.html - external/wpt/css/css-transforms/crashtests/transformed-scroller-snapping.html - external/wpt/css/css-values/crashtests/calc-with-percent-and-number-in-line-height.html - external/wpt/css/css-values/crashtests/transition-asan.html - external/wpt/dom/crashtests/adoptNode-reparenting.html - external/wpt/dom/crashtests/append-child-recurse.html - external/wpt/dom/crashtests/appendChild-document.html - external/wpt/html/semantics/embedded-content/crashtests/iframe-load-before-load.html - external/wpt/html/semantics/obsolete/crashtests/marquee-inside-template-tag.html - external/wpt/html/semantics/obsolete/crashtests/marquee-zero-width.html - external/wpt/html/semantics/text-level-semantics/crashtests/q-empty.html Bug: 485677942 Change-Id: Iba1b136582d0b49248d545a4fd42474c8313b598 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8021270 Reviewed-by: Christian Biesinger <cbiesinger@chromium.org> Commit-Queue: Sharon Yang <yangsharon@igalia.com> Cr-Commit-Position: refs/heads/main@{#1654734} -- wpt-commits: c3f7c5525b13cc82ca0d4c947a6f94d8fa6e4392 wpt-pr: 60978
20 lines
729 B
HTML
20 lines
729 B
HTML
<!DOCTYPE html>
|
|
<meta charset="utf-8">
|
|
<title>Reparenting in removeNode() in adoptNode() should not crash</title>
|
|
<link rel="help" href="https://crbug.com/40509368">
|
|
<div id="test-container"><script>
|
|
var sacrifice;
|
|
let testContainer = document.getElementById('test-container');
|
|
let iframe = document.createElement('iframe');
|
|
testContainer.appendChild(iframe);
|
|
let doc = iframe.contentDocument;
|
|
let script = doc.createElementNS('http://www.w3.org/2000/svg', 'script');
|
|
script.type = 'invalid-type';
|
|
script.textContent = 'document.body.appendChild(parent.sacrifice)';
|
|
sacrifice = document.createElement('div');
|
|
script.appendChild(sacrifice);
|
|
doc.body.appendChild(script);
|
|
script.type = '';
|
|
document.adoptNode(sacrifice);
|
|
</script>
|