LayoutTests/accessibility/updating-attribute-in-table-causes-crash.html - WebKit - Git at Google

 <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
 <html>
 <head>
 <script src="../resources/js-test-pre.js"></script>
 </head>
 <body id="body">

 <table id="table">
 <tr id="row"><td id="tablecell" tabindex=0>1</td><td>2</td></tr>
 <tr id="row2"><td id="tablecell2" tabindex=0>1</td><td>2</td></tr>
 </table>

 <p id="description"></p>
 <div id="console"></div>

 <script>
     description("This tests for a crash that can occur while altering an attribute on a table cell because it accesses the table when its in a bad state.");

     if (window.accessibilityController) {
         document.getElementById("body").focus();
         var body = accessibilityController.focusedElement;
         var tr = document.createElement("tr");
         var td = document.createElement("td");
         td.appendChild(document.createTextNode("asdf"));
         tr.appendChild(td);

         // To reproduce, we need to remove a row and replace with another row, then set an attribute in the meantime.
         document.getElementById("table").getElementsByTagName("TBODY")[0].removeChild(document.getElementById("row2"));
         document.getElementById("table").getElementsByTagName("TBODY")[0].appendChild(tr);
         document.getElementById("tablecell").setAttribute("title", "test");
     }

 </script>

 <script src="../resources/js-test-post.js"></script>
 </body>
 </html>
	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
	<html>
	<head>
	<script src="../resources/js-test-pre.js"></script>
	</head>
	<body id="body">

	<table id="table">
	<tr id="row"><td id="tablecell" tabindex=0>1</td><td>2</td></tr>
	<tr id="row2"><td id="tablecell2" tabindex=0>1</td><td>2</td></tr>
	</table>

	<p id="description"></p>
	<div id="console"></div>

	<script>
	description("This tests for a crash that can occur while altering an attribute on a table cell because it accesses the table when its in a bad state.");

	if (window.accessibilityController) {
	document.getElementById("body").focus();
	var body = accessibilityController.focusedElement;
	var tr = document.createElement("tr");
	var td = document.createElement("td");
	td.appendChild(document.createTextNode("asdf"));
	tr.appendChild(td);

	// To reproduce, we need to remove a row and replace with another row, then set an attribute in the meantime.
	document.getElementById("table").getElementsByTagName("TBODY")[0].removeChild(document.getElementById("row2"));
	document.getElementById("table").getElementsByTagName("TBODY")[0].appendChild(tr);
	document.getElementById("tablecell").setAttribute("title", "test");
	}

	</script>

	<script src="../resources/js-test-post.js"></script>
	</body>
	</html>