Use-after-free of continuation in RenderBlock::paintContinuationOutlines()
[WebKit-https.git] / LayoutTests / fast / css / relative-positioned-block-crash.html
1 <html>
2   <head>
3     <style>
4       #el0 { position: relative; }
5       #el2 { outline-style: dashed; }
6     </style>
7     <script>
8         if (window.layoutTestController) {
9             layoutTestController.display();
10             layoutTestController.waitUntilDone();
11         }
12
13         function log(message) {
14         var console = document.getElementById("console");
15         console.appendChild(document.createTextNode(message + "\n"));
16         }
17
18         function test() {
19            document.execCommand('removeformat');
20            setTimeout("finish()", 100);
21         }
22         function finish() {
23             if (window.layoutTestController) {
24                 layoutTestController.dumpAsText();
25                 log("PASSED: Didn't crash!\n");
26                 layoutTestController.notifyDone();
27             }
28         }
29
30 //         This tests a crash caused by stale pointers to continuations in a block's continuations table.
31 //         https://bugs.webkit.org/show_bug.cgi?id=81276
32
33         function runTest() {
34             el0=document.createElement('span')
35             el0.setAttribute('id','el0')
36             document.body.appendChild(el0)
37             el1=document.createElement('div')
38             el0.appendChild(el1)
39             el1.appendChild(document.createElement('input'))
40             el0.appendChild(document.createTextNode('A'))
41             el2=document.createElement('q')
42             el2.setAttribute('id','el2')
43             document.body.appendChild(el2)
44             el2.appendChild(document.createElement('div'))
45             el2.appendChild(document.createElement('input'))
46             document.designMode='on'
47             document.execCommand('selectall')
48             document.execCommand('FormatBlock', false, '<'+'pre>')
49             document.execCommand('Undo')
50             setTimeout("test();",10)
51          }
52     </script>
53   </head>
54   <body onload="runTest();">
55   <div id="console"></div>
56   </body>
57 </html>