Jelly Bean MR2  |  4.3_r1
Html程序  |  22行  |  821 B 

<html>
<head>
    <title>RenderMenuList::itemStyle Select Element Crash</title>
    <script>
        function removeItem() {
            var select = document.getElementById("dropDown");
            select.removeChild(document.getElementsByTagName("option")[2]);
        }
    </script>
</head>
<body>
    <select id="dropDown" onfocus="setTimeout('removeItem();', 2000);">
        <option>Option 1</option>
        <option>Option 2</option>
        <option>Option 3</option>
    </select>
    <p>This is a test for bug <a href="http://webkit.org/b/34182">34182</a> Crash in WebKit!WebCore::RenderMenuList::itemStyle.
    Once the select gets focus, in 2 seconds it will delete an item. This test passes
    if you have the select open when it deletes an item, and doesn't crash.</p>
</body>
</html>