| <!-- This was found by clusterfuzz. Ensure that |
| AXObjectCacheImpl::ImageLoaded doesn't cause a |
| crash when called on a LayoutObject for an image |
| that's about to be destroyed. --> |
| <body> |
| <base href="#"> |
| <header><img src='anim.gif'></header> |
| |
| <script> |
| if (window.testRunner) |
| testRunner.dumpAsText(); |
| |
| let header = document.querySelector('header'); |
| |
| let img = document.createElement('img'); |
| img.setAttribute('src', 'anim.gif'); |
| header.appendChild(img); |
| |
| // Note: This bug only repros with the deprecated shadow dom v0 API. |
| // The crash doesn't happen if you try to switch this to use |
| // attachShadow and slot. |
| var shadowRoot = header.createShadowRoot(); |
| var content = document.createElement('content'); |
| content.setAttribute('select', '.c6'); |
| shadowRoot.appendChild(content); |
| img.setAttribute('class', 'c6'); |
| document.execCommand(''); |
| img.setAttribute('class', 'c7'); |
| </script> |
| </body> |
