Index: third_party/WebKit/Source/core/html/HTMLInputElementTest.cpp |
diff --git a/third_party/WebKit/Source/core/html/HTMLInputElementTest.cpp b/third_party/WebKit/Source/core/html/HTMLInputElementTest.cpp |
index b8b7b194c985aca0b9faa531ecc232b08af77047..02f4c6a028f7361780190dd1760cc41c3e405854 100644 |
--- a/third_party/WebKit/Source/core/html/HTMLInputElementTest.cpp |
+++ b/third_party/WebKit/Source/core/html/HTMLInputElementTest.cpp |
@@ -59,4 +59,17 @@ TEST(HTMLInputElementTest, DefaultToolTip) |
EXPECT_EQ("<<ValidationValueMissing>>", input->defaultToolTip()); |
} |
+// crbug.com/589838 |
+TEST(HTMLInputElementTest, ImageTypeCrash) |
+{ |
+ RefPtrWillBeRawPtr<Document> document = Document::create(); |
+ RefPtrWillBeRawPtr<HTMLInputElement> input = HTMLInputElement::create(*document, nullptr, false); |
+ input->setAttribute(HTMLNames::typeAttr, "image"); |
+ input->ensureFallbackContent(); |
+ // Make sure ensurePrimaryContent() recreates UA shadow tree, and updating |
+ // |value| doesn't crash. |
+ input->ensurePrimaryContent(); |
+ input->setAttribute(HTMLNames::valueAttr, "aaa"); |
+} |
+ |
} // namespace blink |