bug51140.html | Explore in Territory

<html>
<body>

<script>

function note() {
    var l = document.createElement("div");

    l.innerHTML="<s>jmd</s> jtr was here.";
    l.setAttribute("id", "popup");
    l.style.position = "absolute";

    // afaict only 'tr' causes a crash.  
    // 'td', 'table', 'a1' don't.
    document.getElementById('tr').appendChild(l); 
}

function closepopup() {
  var p = document.getElementById("popup");
  if (p && p.parentNode) {
    // crashes on following line
    p.parentNode.removeChild(p); 
  }
}

</script>

<a id='a1' href='' onclick="              note(); return false;">note</a>
<a id='a2' href='' onclick="closepopup();         return false;">closepopup</a>

<table id='table' border='1'>
 <tr id='tr'>
   <!-- this div is just here to demonstrate that the crash
        only happens with a dhtml-generated div -->
  <div id="popup" style="position:absolute;">
   div
  </div>
  <td id='td'>
   table
  </td>
 </tr>
</table>

</body>
</html>

chromium/third_party/blink/web_tests/tables/mozilla/bugs/bug51140.html