diff options
Diffstat (limited to 'testing/web-platform/tests/dom/events/replace-event-listener-null-browsing-context-crash.html')
| -rw-r--r-- | testing/web-platform/tests/dom/events/replace-event-listener-null-browsing-context-crash.html | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/testing/web-platform/tests/dom/events/replace-event-listener-null-browsing-context-crash.html b/testing/web-platform/tests/dom/events/replace-event-listener-null-browsing-context-crash.html new file mode 100644 index 0000000000..f41955eedd --- /dev/null +++ b/testing/web-platform/tests/dom/events/replace-event-listener-null-browsing-context-crash.html @@ -0,0 +1,16 @@ +<!DOCTYPE html> +<title>Event listeners: replace listener after moving between documents</title> +<link rel="author" title="Nate Chapin" href="mailto:japhet@chromium.org"> +<link rel="help" href="https://w3c.github.io/touch-events/#dom-globaleventhandlers-ontouchcancel"> +<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1083793"> +<meta name="assert" content="Overwriting an attribute event listener after adopting the owning node to a different document should not crash"/> +<progress id="p"> +<iframe id="i"></iframe> +<script> +var p = document.getElementById("p"); +i.contentDocument.adoptNode(p); +p.setAttribute("ontouchcancel", ""); +document.body.appendChild(p); +p.setAttribute("ontouchcancel", ""); +</script> + |