ManualTests/remove-input-file-onchange.html - WebKit - Git at Google

 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
         "http://www.w3.org/TR/html4/strict.dtd">
 <html lang="en">
 <head>
 <script>
 function removeDiv()
 {
     var parent = document.getElementById("parent");
     var child = document.getElementById("child");
     parent.removeChild(child);
 }
 </script>
 </head>
 <body>
 <p><b>BUG ID:</b> <a href="rdar://problem/4621649">4621649</a> repro crash: Upload link causes crash on pages.google.com in Frame::nodeForWidget</p>

 <p id="test" style="background-color:skyblue; padding:3px;"><b>STEPS TO TEST:</b>
 <ol>
 <li> To test this bug, just choose any file
 </ol>
 </p>

 <p id="success" style="background-color:palegreen; padding:3px;"><b>TEST PASS:</b>
 Should see the file chooser disappear and the word "Success" will appear
 </p>

 <p id="failure" style="background-color:#FF3300; padding:3px;"><b>TEST FAIL:</b>
 Safari will crash in WebCore::Frame::nodeForWidget.
 </p>

 <div id="parent">
 <div id="child">
 <form>
 <input id="theFile" type="file" onchange="removeDiv();">
 </form>
 </div>
 </div>


 </body>
 </html>
	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
	"http://www.w3.org/TR/html4/strict.dtd">
	<html lang="en">
	<head>
	<script>
	function removeDiv()
	{
	var parent = document.getElementById("parent");
	var child = document.getElementById("child");
	parent.removeChild(child);
	}
	</script>
	</head>
	<body>
	<p><b>BUG ID:</b> <a href="rdar://problem/4621649">4621649</a> repro crash: Upload link causes crash on pages.google.com in Frame::nodeForWidget</p>

	<p id="test" style="background-color:skyblue; padding:3px;"><b>STEPS TO TEST:</b>
	<ol>
	<li> To test this bug, just choose any file
	</ol>
	</p>

	<p id="success" style="background-color:palegreen; padding:3px;"><b>TEST PASS:</b>
	Should see the file chooser disappear and the word "Success" will appear
	</p>

	<p id="failure" style="background-color:#FF3300; padding:3px;"><b>TEST FAIL:</b>
	Safari will crash in WebCore::Frame::nodeForWidget.
	</p>

	<div id="parent">
	<div id="child">
	<form>
	<input id="theFile" type="file" onchange="removeDiv();">
	</form>
	</div>
	</div>



	</body>
	</html>