| <!doctype html> |
| <!-- This tests for regression of https://crbug.com/279277 where non-adjacent, nested isolates caused a use-after-free if the elements were later removed. --> |
| <script> |
| window.onload = function() { |
| document.body.offsetTop; |
| b.lastChild.parentNode.removeChild(b.lastChild); |
| document.body.offsetTop; |
| a.nextSibling.parentNode.removeChild(a.nextSibling); |
| document.body.offsetTop; |
| |
| document.write("PASS did not crash"); |
| } |
| </script> |
| |
| <body> |
| <div id="a">foo</div><div>baz</div><div></div> |
| <div> |
| <output> |
| <span> |
| <output>bar</output> |
| <span id="b"> |
| <span> |
| <div style="display:inline-block"></div> |
| <br><br> |
| </span> |
| </span> |
| </span> |
| </output> |
| </div> |
| </body> |
| |
| <script> |
| if (window.testRunner) |
| testRunner.dumpAsText(); |
| </script> |
