remove-styles-in-shadow-crash.html | Explore in Territory

<!doctype html>
<html>
<head>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

function runTest() {
    var host = document.getElementById('host');
    var sr = host.attachShadow({mode: 'open'});
    // Test the case: two styles are in shadow dom subtree and they are not
    // direct chilren of the shadow root.
    sr.innerHTML = '<div><style>div { color: blue; }</style>Hello</div><div><style>span { color: red }</style><span>World</span></div>';
    sr.innerHTML = '';

    // Test the case: two styles are in shadow dom subtree, but one is a direct
    // child of shadow root and scoped. The other is not a direct child and
    // not scoped.
    sr.innerHTML = '<style scoped>div { color: blue; }</style>Hello<div><style>span { color: red }</style><span>World</span></div>';
    sr.innerHTML = '';
}
</script>
</head>
<body onload="runTest()">
    <!-- [Bug 100455], https://bugs.webkit.org/show_bug.cgi?id=100455 -->
    <!-- [Shadow]: removing styles in shadow dom subtree causes crash. -->
    <!-- If this test passes, we can see just "PASS" without any crashes. -->
    <div id="host"></div>  
    <div>PASS</div>
</body>
</html>

chromium/third_party/blink/web_tests/fast/dom/shadow/remove-styles-in-shadow-crash.html