LayoutTests/fast/css/css-fontface-rule-crash.html - WebKit - Git at Google

 <html>
 <head>
 <script src="../../resources/gc.js"></script>
 <script>
 if (window.testRunner) {
     testRunner.dumpAsText();
     testRunner.waitUntilDone();
 }

 function load()
 {
     style = document.createElement('style');
     style.textContent = '@font-face { font-family: "A"; }';
     document.head.appendChild(style);
     rulestyle = document.styleSheets[0].cssRules[0].style;
     document.head.removeChild(style);
     style = null;
     setTimeout(crash, 0);
 }

 function crash()
 {
     gc();
     obj = rulestyle.parentRule;
     // If the gc() actually successfully reaps everything it can, then obj
     // will end up null (post-fix). gc() is not guaranteed to reap the font-face
     // rule, however, particularly in the browser context.
     if (obj)
         obj = obj.foo;
     document.body.innerText = 'PASS';
     if (window.testRunner)
         testRunner.notifyDone()
 }
 </script>
 </head>
 <body onload="load()"></body>
 </html>
	<html>
	<head>
	<script src="../../resources/gc.js"></script>
	<script>
	if (window.testRunner) {
	testRunner.dumpAsText();
	testRunner.waitUntilDone();
	}

	function load()
	{
	style = document.createElement('style');
	style.textContent = '@font-face { font-family: "A"; }';
	document.head.appendChild(style);
	rulestyle = document.styleSheets[0].cssRules[0].style;
	document.head.removeChild(style);
	style = null;
	setTimeout(crash, 0);
	}

	function crash()
	{
	gc();
	obj = rulestyle.parentRule;
	// If the gc() actually successfully reaps everything it can, then obj
	// will end up null (post-fix). gc() is not guaranteed to reap the font-face
	// rule, however, particularly in the browser context.
	if (obj)
	obj = obj.foo;
	document.body.innerText = 'PASS';
	if (window.testRunner)
	testRunner.notifyDone()
	}
	</script>
	</head>
	<body onload="load()"></body>
	</html>