Otherwise, the thread will continue to run and access the media data
buffer, which will have been freed.
The test here is a bit strange, but the issue would only consistently
repro after several GC runs.
Seems like a specification bug, but other browsers update url before
popstate event is fired and so should we.
Fixes back/forward navigation on GitHub.
This fixes a regression on Acid3, since we are not expected to "best
effort" parse XML. The test specifically checks that you don't create an
incomplete, incorrect DOM.
See spec issue https://github.com/whatwg/html/issues/9869
Previous attempt on fixing reload had to be reverted because it broke
Soundcloud and GitHub, but this change does not seem to introduce new
crashes.
If the provided ID is smaller than the corner clipping vector, we would
shrink the vector to match. This causes a crash when we have nested
PaintContext instances (as these IDs are allocated by PaintContext),
each of which perform radius painting.
This is seen on https://www.strava.com/login when it loads a reCAPTCHA.
The outer div has a border radius, which contains the reCAPTCHA in an
iframe. That iframe contains an SVG which also has a border radius.
We currently have a handful of iframe tests whose sources are in the
"input" directory. This means they get run as their own tests, when they
are really just helper files. We've had to add empty test expectation
files for these "tests", and invoke a dummy test() method just to keep
the test runner happy.
Instead, move them to their own directory so the test runner does not
see them at all.
