replaceWith <document> in a cycle should not panic

Signed-off-by: Euclid Ye <yezhizhenjiakang@gmail.com>
This commit is contained in:
Euclid Ye
2026-04-25 21:08:13 +08:00
parent 35671d9dde
commit a09c334a52
2 changed files with 17 additions and 0 deletions

View File

@@ -7739,6 +7739,13 @@
null,
{}
]
],
"replaceWith-document-element-crash.html": [
"299542341ad27da315951f7863c3f0198e2ecfcb",
[
null,
{}
]
]
},
"ranges": {

View File

@@ -0,0 +1,10 @@
<!DOCTYPE html>
<meta name="assert" content="Test replaceWith in a cycle">
<link rel=help href="https://github.com/servo/servo/issues/35698">
<link rel="author" title="Euclid Ye" href="mailto:yezhizhenjiakang@gmail.com">
<script>
var oldRoot = document.documentElement;
var newRoot = document.createElement("html");
oldRoot.replaceWith(newRoot);
newRoot.replaceWith(oldRoot);
</script>