xpath-result-eventlistener-crash.html

<html>
<body>
<div id="div"></div>
<p> Test for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=34231">34231</a>: Nodes in XPath result snapshots should keep JS wrappers alive.</p>
<p>This page tests for proper invalidation of a node's event listeners. If the test passes, you'll see a PASS message below.</p>
<pre id="console">FAILED: Test did not run.</pre>
<script>
function $(id)
{
    return document.getElementById(id);
}

function log(s)
{
    $('console').innerHTML = s + '\n';
}

function allocate() {
    for (var i = 0; i < 3000; ++i)
        String(i);
}

(function () {
    if (window.testRunner)
        testRunner.dumpAsText();

    // Fill the heap with event listeners...
    var a = []
    for (var i = 0; i < 5000; ++i)
        a[a.length] = function() { };

    // ...followed by a DOM node wrapper
    var div = $("div");

    // Add the listeners to the DOM node.
    for (var i = 0; i < a.length; ++i)
        div.addEventListener("click", a[i], false);

    // Eliminate JS references to the div and its listeners, but keep a reference to the div in an XPath query.
    var query = document.evaluate("//div", document.documentElement, null, XPathResult.UNORDERED_NODE_SNAPSHOT_TYPE, null);
    div.parentNode.removeChild(div);
    div = null
    a = null;

    // Potentially overwrite listeners with strings, but don't overwrite div.
    allocate();

    // Fire listeners and see if we crash.
    var event = document.createEvent('MouseEvent');
    event.initEvent('click', true, true);
    query.snapshotItem(0).dispatchEvent(event);

    log("PASS: You didn't crash.");
})();
</script>
</body></html>
chromium/third_party/blink/web_tests/fast/xpath/xpath-result-eventlistener-crash.html
