blob: 55f55ced3b01f9c12b34b71a8cd66b0c877a929f [file] [log] [blame]
<!DOCTYPE html>
<div>Tests for a crash due to modifying the DOM during mutation events due to an adoptNode call. If this page doesn't crash and DOMSubtreeModified is fire, this test succeeds.</div>
<div id="result"></div>
<div id="node-to-adopt"></div>
<iframe></iframe>
<script>
if (window.testRunner)
testRunner.dumpAsText();
var nodeToAdopt = document.getElementById('node-to-adopt');
var mutationHandler = function() {
document.body.removeEventListener('DOMSubtreeModified', mutationHandler, true);
document.getElementById('result').innerHTML = "DOMSubtreeModified fired";
document.body.appendChild(nodeToAdopt);
};
document.body.addEventListener('DOMSubtreeModified', mutationHandler, true);
var iframe = document.querySelector('iframe');
var iframeDoc = iframe.contentDocument;
iframeDoc.adoptNode(nodeToAdopt);
// The crash happens when the iframe's document is getting detached.
document.body.removeChild(iframe);
</script>