LayoutTests/fast/forms/form-associated-element-crash.html - WebKit - Git at Google

 <html>
 <head>
 <script>
 if (window.testRunner) {
     testRunner.dumpAsText();
     testRunner.waitUntilDone();
 }

 if (!window.gc) {
     gc = function () {
         if (window.GCController)
             return GCController.collect();
         for (var i = 0; i < 10000; i++)
             var s = new String("abc");
     }
 }

 var element = document.createElement('input');

 function test() {
     element.setAttribute('form', 'form1');
     document.body.appendChild(element);
     element.attributes.removeNamedItem('form');
     setTimeout(delay, 0);
 }

 function delay() {
     document.body.removeChild(element);
     element = 0;
     gc();
     var form = document.createElement('form');
     form.setAttribute('id', 'form2');
     document.body.appendChild(form);
     if (window.testRunner)
         testRunner.notifyDone();
 }
 </script>
 </head>
 <body onload="test()">
 <p>
 This page is a test case for <a href="https://bugs.webkit.org/show_bug.cgi?id=51905">Bug 51905</a>. WebKit should not crash when this page is loaded.
 </p>
 PASS
 </body>
 </html>
	<html>
	<head>
	<script>
	if (window.testRunner) {
	testRunner.dumpAsText();
	testRunner.waitUntilDone();
	}

	if (!window.gc) {
	gc = function () {
	if (window.GCController)
	return GCController.collect();
	for (var i = 0; i < 10000; i++)
	var s = new String("abc");
	}
	}

	var element = document.createElement('input');

	function test() {
	element.setAttribute('form', 'form1');
	document.body.appendChild(element);
	element.attributes.removeNamedItem('form');
	setTimeout(delay, 0);
	}

	function delay() {
	document.body.removeChild(element);
	element = 0;
	gc();
	var form = document.createElement('form');
	form.setAttribute('id', 'form2');
	document.body.appendChild(form);
	if (window.testRunner)
	testRunner.notifyDone();
	}
	</script>
	</head>
	<body onload="test()">
	<p>
	This page is a test case for <a href="https://bugs.webkit.org/show_bug.cgi?id=51905">Bug 51905</a>. WebKit should not crash when this page is loaded.
	</p>
	PASS
	</body>
	</html>