Index: third_party/WebKit/LayoutTests/fast/frames/expand-grid-with-zero-size-child-frameset-crash.html |
diff --git a/third_party/WebKit/LayoutTests/fast/frames/expand-grid-with-zero-size-child-frameset-crash.html b/third_party/WebKit/LayoutTests/fast/frames/expand-grid-with-zero-size-child-frameset-crash.html |
new file mode 100644 |
index 0000000000000000000000000000000000000000..f1adebe4d27a0e08fa02623afa9e7ceafd619712 |
--- /dev/null |
+++ b/third_party/WebKit/LayoutTests/fast/frames/expand-grid-with-zero-size-child-frameset-crash.html |
@@ -0,0 +1,18 @@ |
+<script> |
+ if (window.testRunner) |
+ testRunner.dumpAsText(); |
+ onload = ()=> { |
+ // Force layout first. |
+ document.documentElement.offsetTop; |
+ |
+ // Then expand the root frameset grid from 2x1 to 2x2. |
+ document.getElementById("rootSet").setAttribute("rows", "*, 0"); |
+ } |
+</script> |
+<frameset id="rootSet" cols="0, *"> |
+ <frame id="firstChild"></frame> |
+ <frame src="data:text/html,PASS if no crash or assertion failure."></frame> |
+ <frameset> |
+ <frame src="data:text/html,3"></frame> |
+ </frameset> |
+</frameset> |