Index: third_party/WebKit/LayoutTests/fast/css/document-rare-data-style-crash.html |
diff --git a/third_party/WebKit/LayoutTests/fast/css/document-rare-data-style-crash.html b/third_party/WebKit/LayoutTests/fast/css/document-rare-data-style-crash.html |
new file mode 100644 |
index 0000000000000000000000000000000000000000..8c6fd46f1d190ad259ec0140a43be6d94f44ccf0 |
--- /dev/null |
+++ b/third_party/WebKit/LayoutTests/fast/css/document-rare-data-style-crash.html |
@@ -0,0 +1,12 @@ |
+<!-- Test for crbug.com/638102 --> |
+<p>Test for crash when a Document with rare data's style is accessed</p> |
+<p>PASS if does not crash in debug</p> |
+<svg> |
+ <rect height="15rem" id="rect"></rect> |
+</svg> |
+<script> |
+ doc = document.implementation.createDocument("", ""); |
+ doc.appendChild(rect); |
+ doc.childNodes[0]; |
+ doc.documentElement['height']['baseVal']['value']; |
+</script> |