<!DOCTYPE html>
<html>
<body>
<div>Test passes if it does not crash.</div>
<script>
if (window.testRunner) {
testRunner.dumpAsText();
testRunner.waitUntilDone();
}
function reloadUntil(max) {
var index = window.location.href.indexOf("?");
if (index == -1) {
window.location.href = window.location.href + "?1";
} else {
var num = parseInt(window.location.href.substring(index + 1));
if (num == max) {
if (window.testRunner)
testRunner.notifyDone();
} else {
window.location.href = window.location.href.substring(0, index + 1) + (num + 1);
}
}
}
function init() {
var shadowHost = document.createElement("div");
var shadowRoot = shadowHost.attachShadow({mode: 'open'});
var child = document.createElement("span");
shadowRoot.appendChild(child);
child.style.zoom = 34;
var styleAttr = child.attributes[0];
child.removeAttribute("style");
shadowHost.appendChild(shadowRoot);
// The crash (use-after-free) is flaky. We have to reload the page a number of times to reproduce the crash.
// I couldn't find a reliable way to reproduce, such as using gc(), adjusting the scopes of variables and so on.
// As of now, we can hit a crash by reloading about 50 times.
// Reload 30 times here since reloading 80 times caused flaky timeout on Win. See crbug.com/481269.
reloadUntil(30);
}
document.addEventListener("DOMContentLoaded", init, false);
</script>
</body>
</html>
Codebase Browser
chromium