div-within-anchors-causes-crash.html

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN"> 
<html> 
<head>
<!-- <script> 

    function buildAccessibilityTree(accessibilityObject, indent) {
        var str = "";
        for (var i = 0; i < indent; i++)
            str += "    ";
        str += accessibilityObject.role;
        str += " " + accessibilityObject.stringValue;
        str += "\n";
        document.getElementById("tree").innerText += str;

        if (accessibilityObject.stringValue.indexOf('End of test') >= 0)
            return false;

        var count = accessibilityObject.childrenCount;
        for (var i = 0; i < count; ++i) {
            if (!buildAccessibilityTree(accessibilityObject.childAtIndex(i), indent + 1))
                return false;
        }

        return true;
    }
</script> -->
<script src="../resources/js-test.js"></script>
<script src="../resources/accessibility-helper.js"></script>
</head> 
<body> 

<div id="container">
 
<a><div></div></a>

<a><div></div></a>

<a href="about:blank"><div></div></a> 

<div>End of test</div>

</div>

<p id="description"></p> 
<div id="console"></div> 
 
<script> 
    description("This can cause a crash.");
 
    if (window.accessibilityController) {
        // First build up full accessibility tree.
        document.getElementById("console").innerText += "Before:\n";
        buildAccessibilityTree(
            accessibilityController.accessibleElementById("container"), 0);
        
        // Remove anchor that causes debug assert in AccessibilityRenderObject::addChildren
        let container = document.getElementById("container");
        container.removeChild(container.children[2])
        
        // Build up full accessibility tree again.
        document.getElementById("console").innerText += "After:\n";
        buildAccessibilityTree(
            accessibilityController.accessibleElementById("container"), 0);
    }
 
</script> 
 
</body> 
</html>
chromium/third_party/blink/web_tests/accessibility/div-within-anchors-causes-crash.html
