NodeIterator-attr.html | Explore in Territory

<!DOCTYPE html>
<html>
<head>
<title>NodeIterator: Attr crash test</title>
<script src="../../../resources/testharness.js"></script>
<script src="../../../resources/testharnessreport.js"></script>
<link rel="stylesheet" href="../../../resources/testharness.css">
</head>
<body>
<script>

test(function() {
    var div = document.createElement("div");
    div.setAttribute('align', 'right');
    var detachedAttr = div.attributes[0];
    div.removeAttribute(detachedAttr.name);

    document.createNodeIterator(detachedAttr);
    gc();

    // Try migrating an element to other document.
    // This invokes blink::Document::moveNodeIteratorsToNewDocument(),
    // which will choke unless node iterators book-keeping is correct.
    var otherDocument = document.implementation.createDocument('', null);
    var div2 = document.createElement("div");
    otherDocument.appendChild(div2);
}, "NodeIterator targeting detached attr node shouldn't crash.");

</script>
</body>
</html>

chromium/third_party/blink/web_tests/fast/dom/NodeIterator/NodeIterator-attr.html