Index: LayoutTests/fast/images/image-load-event-crash.html |
diff --git a/LayoutTests/fast/images/image-load-event-crash.html b/LayoutTests/fast/images/image-load-event-crash.html |
new file mode 100644 |
index 0000000000000000000000000000000000000000..9f81764f66cb08c3e3a049d1c5c299b1a606010f |
--- /dev/null |
+++ b/LayoutTests/fast/images/image-load-event-crash.html |
@@ -0,0 +1,22 @@ |
+<!DOCTYPE html> |
+<head> |
+<style> |
+img { |
+ background-image: url("data:image/svg+xml,<svg></svg>"); |
+} |
+</style> |
+<script> |
+function changeStyleAndLayout() { |
+ document.body.style.height = '100px'; |
+ var forceLayout = document.body.offsetWidth; |
+ if (window.testRunner) |
+ testRunner.dumpAsText(); |
+} |
+</script> |
+</head> |
+<body> |
+ Test for crbug.com/248843: This test passes if it does not crash.<br/> |
+ <img onload="changeStyleAndLayout()" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12P4//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg=="> |
+</body> |
+</html> |
+ |