| <!DOCTYPE html> |
| <script src="../../resources/testharness.js"></script> |
| <script src="../../resources/testharnessreport.js"></script> |
| <div id="test-container"><script> |
| var sacrifice; |
| test(() => { |
| let testContainer = document.getElementById('test-container'); |
| let iframe = document.createElement('iframe'); |
| testContainer.appendChild(iframe); |
| let doc = iframe.contentDocument; |
| let script = doc.createElementNS('http://www.w3.org/2000/svg', 'script'); |
| script.type = 'invalid-type'; |
| script.textContent = 'document.body.appendChild(parent.sacrifice)'; |
| sacrifice = document.createElement('div'); |
| script.appendChild(sacrifice); |
| doc.body.appendChild(script); |
| script.type = ''; |
| // adoptNode() calls script.removeNode(sacrifice) internally, and this DOM |
| // mutation kicks the script. |
| document.adoptNode(sacrifice); |
| }, 'Reparenting in removeNode() in adoptNode() should not crash.'); |
| </script> |
