| <!-- This document must be xhtml for the crash to occur --> |
| <li xmlns="http://www.w3.org/1999/xhtml"> |
| <h1 id="x">x<h1></h1></h1> |
| <script><![CDATA[ |
| if (testRunner) |
| testRunner.dumpAsText(); |
| |
| // Calling accessibleElementById on a nonexistant id has the side effect |
| // of creating an accessibility object for every node in the tree. |
| if (accessibilityController) |
| accessibilityController.accessibleElementById('dummy'); |
| |
| // Calling insertAdjacentHTML causes the cached parent of an |
| // AXLayoutObject to be invalid after the next layout. |
| x=document.getElementById("x"); |
| x.insertAdjacentHTML("beforebegin", "text"); |
| |
| // Force layout. |
| x.offsetTop; |
| |
| // Explore the accessibility tree again, triggering the crash if |
| // the cached parent isn't updated correctly. |
| if (accessibilityController) |
| accessibilityController.accessibleElementById('dummy'); |
| ]]></script> |
| </li> |
