Index: third_party/WebKit/LayoutTests/fast/css/remove-stylesheet-from-shadow-form-crash.html |
diff --git a/third_party/WebKit/LayoutTests/fast/css/remove-stylesheet-from-shadow-form-crash.html b/third_party/WebKit/LayoutTests/fast/css/remove-stylesheet-from-shadow-form-crash.html |
new file mode 100644 |
index 0000000000000000000000000000000000000000..b304cfec9a42e7c0941dbcc380b5fac7c80d4878 |
--- /dev/null |
+++ b/third_party/WebKit/LayoutTests/fast/css/remove-stylesheet-from-shadow-form-crash.html |
@@ -0,0 +1,19 @@ |
+<!DOCTYPE html> |
+<style></style> |
+<p>PASS if no crash.</p> |
+<div id="div"></div> |
+<script> |
+ if (window.testRunner) |
+ testRunner.dumpAsText(); |
+ |
+ var div = document.getElementById("div"); |
+ var shadowRoot = div.createShadowRoot(); |
+ shadowRoot.innerHTML = "<form><input></input></form>"; |
+ |
+ // Force a style recalc. |
+ getComputedStyle(document.body).color; |
+ |
+ var input = shadowRoot.querySelector("input"); |
+ input.appendChild(document.createElement("style")); |
+ input.remove(); |
+</script> |