| <head> |
| <style> |
| .gone { display:none } |
| </style> |
| <script> |
| if (window.testRunner) |
| testRunner.dumpAsText(); |
| </script> |
| <body> |
| Loading this page should not crash. |
| <table> |
| <td id=td1> |
| .<input id=cb type="checkbox">. |
| </table> |
| <script> |
| var sel = window.getSelection(); |
| var td1 = document.getElementById('td1') |
| // having selection triggers Document::updateRendering() from paint() |
| sel.setBaseAndExtent(td1, 0, td1, 1000); |
| // this causes style recalc and rendering tree tear down (from updateRendering) in middle of painting, which crashes |
| document.body.setAttribute('class','gone'); |
| var cb = document.getElementById('cb') |
| // this triggers synchronous paint() |
| cb.click(); |
| document.body.setAttribute('class',''); |
| </script> |
| </body> |
| |
