| <!DOCTYPE html> |
| <html> |
| <body> |
| <div>Test passes if it does not crash.</div> |
| <script> |
| if (window.testRunner) { |
| testRunner.dumpAsText(); |
| testRunner.waitUntilDone(); |
| } |
| |
| function reloadUntil(max) { |
| var index = window.location.href.indexOf("?"); |
| if (index == -1) { |
| window.location.href = window.location.href + "?1"; |
| } else { |
| var num = parseInt(window.location.href.substring(index + 1)); |
| if (num == max) { |
| if (window.testRunner) |
| testRunner.notifyDone(); |
| } else { |
| window.location.href = window.location.href.substring(0, index + 1) + (num + 1); |
| } |
| } |
| } |
| |
| function init() { |
| var shadowHost = document.createElement("SHADOWHOST"); |
| var shadowRoot = shadowHost.createShadowRoot(); |
| var child = document.createElement("CHILD"); |
| shadowRoot.appendChild(child); |
| child.style.zoom = 34; |
| var styleAttr = child.attributes[0]; |
| child.removeAttribute("style"); |
| shadowHost.appendChild(shadowRoot); |
| |
| // The crash (use-after-free) is flaky. We have to reload the page a number of times to reproduce the crash. |
| // I couldn't find a reliable way to reproduce, such as using gc(), adjusting the scopes of variables and so on. |
| // As of now, we can hit a crash by reloading about 50 times. |
| // Reload 30 times here since reloading 80 times caused flaky timeout on Win. See crbug.com/481269. |
| reloadUntil(30); |
| } |
| |
| document.addEventListener("DOMContentLoaded", init, false); |
| </script> |
| </body> |
| </html> |
