mirror of
https://github.com/LadybirdBrowser/ladybird.git
synced 2025-10-25 01:19:45 +00:00
d5be18617e
We hold a raw pointer to the mouse selection target, which is a mixin- style class inherited only by JS::Cell classes. By not visiting this object, we sometime had a dangling reference to it after it had been garbage collected.
37 lines
1,014 B
HTML
37 lines
1,014 B
HTML
<!DOCTYPE html>
|
|
<iframe id="iframe"></iframe>
|
|
<script src="../include.js"></script>
|
|
<script>
|
|
const runTest = () => {
|
|
return new Promise(resolve => {
|
|
let iframe = document.getElementById("iframe");
|
|
|
|
iframe.onload = () => {
|
|
internals.movePointerTo(20, 40);
|
|
internals.mouseDown(20, 40);
|
|
internals.movePointerTo(60, 40);
|
|
|
|
iframe.onload = () => {
|
|
setTimeout(() => {
|
|
internals.movePointerTo(20, 40);
|
|
resolve();
|
|
});
|
|
};
|
|
|
|
iframe.src = "data:text/html,<p contenteditable>Text 2</p>";
|
|
};
|
|
|
|
iframe.src = "data:text/html,<p contenteditable>Text 1</p>";
|
|
});
|
|
};
|
|
|
|
asyncTest(async done => {
|
|
for (let i = 0; i < 10; ++i) {
|
|
await runTest();
|
|
internals.gc();
|
|
}
|
|
|
|
println("PASS (didn't crash)");
|
|
done();
|
|
});
|
|
</script>
|