Commit 658d166b authored by Ting-Yu Lin's avatar Ting-Yu Lin
Browse files

Bug 1678469 - Add a wpt crashtest for removing a child under a flex container... 

Bug 1678469 - Add a wpt crashtest for removing a child under a flex container with size and layout containment. r=emilio

bug 1679819 fixed this crash by preventing a "contain:size" element from
being fragmented.

Differential Revision: https://phabricator.services.mozilla.com/D98228
parent c72f25a7

testing/web-platform/tests/css/css-flexbox/contain-size-layout-abspos-flex-container-crash.html

0 → 100644
+37 −0
Original line number Diff line number Diff line 
<!DOCTYPE html>

<html>

  <meta charset="UTF-8">

  <link rel="author" title="Ting-Yu Lin" href="mailto:tlin@mozilla.com">

  <link rel="author" title="Mozilla" href="https://www.mozilla.org/">

  <link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1678469">

  <meta name="assert" content="This test ensures that the browser does not crash after removing the element 'c'.">



  <style>

  html { columns: 0 }

  body {

    transform: rotate(14deg);

  }

  #flex-container {

    display: flex;

    contain: size layout;

    position: absolute;

    width: 100px;

    height: 100px;

  }

  </style>



  <script>

  function boom() {

    let flex = document.getElementById('flex-container');

    let c = document.getElementById('c');

    flex.removeChild(c);

  }

  </script>



  <body onload="boom()">

    <div id="flex-container">

      x

      <div id="c"></div>

    </div>

  </body>

</html>