Index: third_party/WebKit/LayoutTests/fast/dom/custom/crash-in-getTypeExtension.html |
diff --git a/third_party/WebKit/LayoutTests/fast/dom/custom/crash-in-getTypeExtension.html b/third_party/WebKit/LayoutTests/fast/dom/custom/crash-in-getTypeExtension.html |
new file mode 100644 |
index 0000000000000000000000000000000000000000..3d932f7a65bc78b9eb73dbab8eb71924a4333cf5 |
--- /dev/null |
+++ b/third_party/WebKit/LayoutTests/fast/dom/custom/crash-in-getTypeExtension.html |
@@ -0,0 +1,10 @@ |
+<!DOCTYPE html> |
+<script src="../../../resources/testharness.js"></script> |
+<script src="../../../resources/testharnessreport.js"></script> |
+<script> |
+test(() => { |
+ try { |
+ document.createElement("option", { toString: () => { throw "It is fake string!"; } }); |
+ } catch (e) {} |
+}, "Test for crbug/666610: Crash in blink::getTypeExtension"); |
+</script> |