From eff69b907ef2cd3a9af0351287a929c66f58e3f6 Mon Sep 17 00:00:00 2001
From: Steve Block <steveblock@google.com>
Date: Tue, 7 Sep 2010 16:06:44 +0100
Subject: Adds a number of fast/ LayoutTest directories to the triaged set

Tests are added at r66079. All tests pass

fast/constructors/
fast/cookies/
fast/dom/Attr/
fast/dom/CSSStyleDeclaration/
fast/dom/DOMImplementation/
fast/dom/DeviceMotion/
fast/dom/EntityReference/
fast/dom/HTMLAnchorElement/
fast/dom/HTMLButtonElement/
fast/dom/HTMLFontElement/
fast/dom/HTMLFormElement/
fast/dom/HTMLHtmlElement/
fast/dom/HTMLKeygenElement/
fast/dom/HTMLLabelElement/
fast/dom/HTMLMetaElement/
fast/dom/HTMLTableRowElement/
fast/dom/HTMLTableSectionElement/
fast/dom/Node/
fast/dom/NodeList/
fast/dom/Selection/
fast/dom/StyleSheet/
fast/dom/Text/
fast/dom/TreeWalker/
fast/dom/beforeload/
fast/dom/getElementsByClassName/
fast/leaks/

Change-Id: I9a2c401151f7abf5bb22b764b1327022ab651e04
---
 .../access-after-element-destruction.js            | 55 ++++++++++++++++++++++
 1 file changed, 55 insertions(+)
 create mode 100644 LayoutTests/fast/dom/Attr/script-tests/access-after-element-destruction.js

(limited to 'LayoutTests/fast/dom/Attr/script-tests/access-after-element-destruction.js')

diff --git a/LayoutTests/fast/dom/Attr/script-tests/access-after-element-destruction.js b/LayoutTests/fast/dom/Attr/script-tests/access-after-element-destruction.js
new file mode 100644
index 0000000..91588a3
--- /dev/null
+++ b/LayoutTests/fast/dom/Attr/script-tests/access-after-element-destruction.js
@@ -0,0 +1,55 @@
+description("Tests that accessing Attr after its Element has been destroyed works without crashing.");
+
+function gc()
+{
+    if (window.GCController)
+        return GCController.collect();
+
+    // Trigger garbage collection indirectly.
+    for (var i = 0; i < 100000; i++)
+        new String(i);
+}
+
+var element = document.createElement("p");
+element.setAttribute("a", "b");
+var attributes = element.attributes;
+element = null;
+
+gc();
+
+shouldBe("attributes.length", "1");
+shouldBe("attributes[0]", "attributes.item(0)");
+shouldBe("attributes.getNamedItem('a')", "attributes.item(0)");
+
+shouldBe("attributes.item(0).name", "'a'");
+shouldBe("attributes.item(0).specified", "true");
+shouldBe("attributes.item(0).value", "'b'");
+shouldBe("attributes.item(0).ownerElement.tagName", "'P'");
+shouldBe("attributes.item(0).style", "null");
+
+attributes.item(0).value = 'c';
+
+shouldBe("attributes.item(0).value", "'c'");
+
+attributes.removeNamedItem('a');
+
+shouldBe("attributes.length", "0");
+
+element = document.createElement("p");
+element.setAttribute("a", "b");
+var attr = element.attributes.item(0);
+element = null;
+
+gc();
+
+shouldBe("attr.name", "'a'");
+shouldBe("attr.specified", "true");
+shouldBe("attr.value", "'b'");
+shouldBe("attr.ownerElement.tagName", "'P'");
+shouldBe("attr.style", "null");
+
+attr.value = 'c';
+
+shouldBe("attr.value", "'c'");
+
+var successfullyParsed = true;
-- 
cgit v1.1