Submitting a form can cause HTMLFormElement's associated elements vector to be mutate...
[WebKit-https.git] / LayoutTests / fast / forms / append-children-during-form-submission.html
1 <!DOCTYPE html>
2 <html>
3 <script>
4 function loaded() {
5     if (window.testRunner)
6         testRunner.dumpAsText();
7
8     area1.setRangeText("foo");
9     area1.name = "foo";
10     area2.autofocus = true;
11     form.insertBefore(area2, form.firstChild);
12     form.submit();
13 }
14
15 function changed() {
16     for (let i = 0; i < 100; i++)
17         form.appendChild(document.createElement("input"));
18 }
19 </script>
20
21 <body onload=loaded()>
22 <form id="form" onchange=changed()>
23     <textarea id="area1">a</textarea>
24     <object></object>
25     <textarea id="area2">b</textarea>
26 </form>
27 <p>To manually test, load this page. The web process should not crash.</p>
28 </body>
29 </html>