plug-in-mutates-NSView-hierarchy-during-resize.html   [plain text]

<style>
    div { padding: 10px; margin: 8px; }
    embed { width: 50px; height: 50px; }
    iframe { width: 50px; height: 50px; }
</style>
<script>
    var callCount = 0;

    function hideFirst()
    {
        if (++callCount != 2)
            return;

        var target = document.getElementById("target");
        if (!target)
            return;

        target.parentNode.removeChild(target);
        document.body.offsetTop;
    }
</script>
<p>
    Test that plug-ins cannot cause the NSView hierarchy to change beneath <tt>-[NSView _invalidateGStatesForTree]</tt>.
</p>
<p>
    To test, resize the browser window. Reload and repeat a few times. Each time you resize, the orange rectangle and
    its contents should vanish, and the browser should not crash.
</p>
<div id="target" style="border: solid orange;">
    <embed type="application/x-webkit-test-netscape"></embed>
    <iframe src=""></iframe>
    <iframe src=""></iframe>
    <iframe src=""></iframe>
</div>
<div style="border: solid blue;">
    <embed type="application/x-webkit-test-netscape" onsetwindow="hideFirst()"></embed>
</div>