LayoutTests/accessibility/div-within-anchors-causes-crash.html - WebKit - Git at Google

 <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
 <html>
 <head>
 <script src="../resources/js-test-pre.js"></script>
 <script src="../resources/accessibility-helper.js"></script>
 </head>
 <body>

 <a><div></div></a>

 <a><div></div></a>

 <a href="about:blank"><div></div></a>

 <div id="stopElement">End of test</div>

 <pre id="tree"></pre>

 <p id="description"></p>
 <div id="console"></div>

 <script>
     description("This can cause a crash.");

     if (window.accessibilityController) {
         // First build up full accessibility tree.
         window.stopElement = accessibilityController.accessibleElementById("stopElement");

         document.getElementById("tree").innerText += "Before:\n";
         document.body.focus();
         dumpAccessibilityTree(accessibilityController.focusedElement, stopElement, 0);

         // Remove anchor that causes debug assert in AccessibilityRenderObject::addChildren
         document.body.removeChild(document.body.children[2])

         // Build up full accessibility tree again.
         document.getElementById("tree").innerText += "After:\n";
         document.body.focus();
         dumpAccessibilityTree(accessibilityController.focusedElement, stopElement, 0);
     }

 </script>

 <script src="../resources/js-test-post.js"></script>
 </body>
 </html>
	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
	<html>
	<head>
	<script src="../resources/js-test-pre.js"></script>
	<script src="../resources/accessibility-helper.js"></script>
	</head>
	<body>

	<a><div></div></a>

	<a><div></div></a>

	<a href="about:blank"><div></div></a>

	<div id="stopElement">End of test</div>

	<pre id="tree"></pre>

	<p id="description"></p>
	<div id="console"></div>

	<script>
	description("This can cause a crash.");

	if (window.accessibilityController) {
	// First build up full accessibility tree.
	window.stopElement = accessibilityController.accessibleElementById("stopElement");

	document.getElementById("tree").innerText += "Before:\n";
	document.body.focus();
	dumpAccessibilityTree(accessibilityController.focusedElement, stopElement, 0);

	// Remove anchor that causes debug assert in AccessibilityRenderObject::addChildren
	document.body.removeChild(document.body.children[2])

	// Build up full accessibility tree again.
	document.getElementById("tree").innerText += "After:\n";
	document.body.focus();
	dumpAccessibilityTree(accessibilityController.focusedElement, stopElement, 0);
	}

	</script>

	<script src="../resources/js-test-post.js"></script>
	</body>
	</html>