access-after-element-destruction.html

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<script src="../../resources/gc.js"></script>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
</head>
<body>
<script>
var test = async_test("Tests that accessing Attr after its Element has been destroyed works without crashing");

var element = document.createElement("p");
element.setAttribute("a", "b");
var attributes = element.attributes;
element = null;
var attr = null;

asyncGC(test.step_func(() => {
    assert_equals(attributes.length, 1);
    assert_equals(attributes[0], attributes.item(0));
    assert_equals(attributes.getNamedItem('a'), attributes.item(0));

    assert_equals(attributes.item(0).name, "a");
    assert_equals(attributes.item(0).value, "b");
    assert_equals(attributes.item(0).ownerElement.tagName, "P");

    attributes.item(0).value = 'c';

    assert_equals(attributes.item(0).value, "c");

    attributes.removeNamedItem('a');

    assert_equals(attributes.length, 0);

    element = document.createElement("p");
    element.setAttribute("a", "b");
    attr = element.attributes.item(0);
    element = null;

    asyncGC(test.step_func_done(() => {

        assert_equals(attr.name, "a");
        assert_equals(attr.value, "b");
        assert_equals(attr.ownerElement.tagName, "P");

        attr.value = 'c';

        assert_equals(attr.value, "c");
    }));
}));
</script>
</body>
</html>
chromium/third_party/blink/web_tests/dom/attr/access-after-element-destruction.html
