LayoutTests/fast/dynamic/checkbox-selection-crash.html - WebKit - Git at Google

 <head>
 <style>
 .gone { display:none }
 </style>
 <script>
 if (window.testRunner)
     testRunner.dumpAsText();
 </script>
 <body>
 Loading this page should not crash.
 <table>
 <td id=td1>
 .<input id=cb type="checkbox">.
 </table>
 <script>
     var sel = window.getSelection();
     var td1 = document.getElementById('td1')
     // having selection triggers Document::updateRendering() from paint()
     sel.setBaseAndExtent(td1, 0, td1, 1000);
     // this causes style recalc and rendering tree tear down (from updateRendering) in middle of painting, which crashes
     document.body.setAttribute('class','gone');
     var cb = document.getElementById('cb')
     // this triggers synchronous paint()
     cb.click();
     document.body.setAttribute('class','');
 </script>
 </body>
	<head>
	<style>
	.gone { display:none }
	</style>
	<script>
	if (window.testRunner)
	testRunner.dumpAsText();
	</script>
	<body>
	Loading this page should not crash.
	<table>
	<td id=td1>
	.<input id=cb type="checkbox">.
	</table>
	<script>
	var sel = window.getSelection();
	var td1 = document.getElementById('td1')
	// having selection triggers Document::updateRendering() from paint()
	sel.setBaseAndExtent(td1, 0, td1, 1000);
	// this causes style recalc and rendering tree tear down (from updateRendering) in middle of painting, which crashes
	document.body.setAttribute('class','gone');
	var cb = document.getElementById('cb')
	// this triggers synchronous paint()
	cb.click();
	document.body.setAttribute('class','');
	</script>
	</body>