<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<script src="../resources/js-test.js"></script>
</head>
<body id="body">
<table id="table">
<tr id="row"><td id="tablecell" tabindex=0>1</td><td>2</td></tr>
<tr id="row2"><td id="tablecell2" tabindex=0>1</td><td>2</td></tr>
</table>
<p id="description"></p>
<div id="console"></div>
<script>
description("This tests for a crash that can occur while altering an attribute on a table cell because it accesses the table when its in a bad state.");
if (window.accessibilityController) {
document.getElementById("body").focus();
var body = accessibilityController.focusedElement;
var tr = document.createElement("tr");
var td = document.createElement("td");
td.appendChild(document.createTextNode("asdf"));
tr.appendChild(td);
// To reproduce, we need to remove a row and replace with another row, then set an attribute in the meantime.
document.getElementById("table").getElementsByTagName("TBODY")[0].removeChild(document.getElementById("row2"));
document.getElementById("table").getElementsByTagName("TBODY")[0].appendChild(tr);
document.getElementById("tablecell").setAttribute("title", "test");
}
</script>
</body>
</html>
Codebase Browser
chromium