Index: third_party/WebKit/LayoutTests/fast/css/containment/inline-contain-layout-crash.html |
diff --git a/third_party/WebKit/LayoutTests/fast/css/containment/inline-contain-layout-crash.html b/third_party/WebKit/LayoutTests/fast/css/containment/inline-contain-layout-crash.html |
new file mode 100644 |
index 0000000000000000000000000000000000000000..855130484b846cc7301b78a0ff5e0bdd83b9bb07 |
--- /dev/null |
+++ b/third_party/WebKit/LayoutTests/fast/css/containment/inline-contain-layout-crash.html |
@@ -0,0 +1,17 @@ |
+<style> |
+span { contain: size layout; } |
+</style> |
+<script> |
+function leak() { |
+ if (window.testRunner) |
+ testRunner.dumpAsText(); |
+ document.execCommand("selectAll"); |
+ opt.text = ""; |
+} |
+</script> |
+<body onload=leak()> |
+<span> |
+<select> |
+<option id="opt">aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa</option> |
+</select> |
+</span> |