Index: third_party/WebKit/LayoutTests/fast/css/crash-in-attachFirstLetterTextLayoutObjects.html |
diff --git a/third_party/WebKit/LayoutTests/fast/css/crash-in-attachFirstLetterTextLayoutObjects.html b/third_party/WebKit/LayoutTests/fast/css/crash-in-attachFirstLetterTextLayoutObjects.html |
new file mode 100644 |
index 0000000000000000000000000000000000000000..dcd8ddafb50b558448a2452ae07e026d35de4003 |
--- /dev/null |
+++ b/third_party/WebKit/LayoutTests/fast/css/crash-in-attachFirstLetterTextLayoutObjects.html |
@@ -0,0 +1,20 @@ |
+<!DOCTYPE html> |
+<script src="../../resources/testharness.js"></script> |
+<script src="../../resources/testharnessreport.js"></script> |
+<style> |
+.c3 { -webkit-appearance: button; } |
+.c3:nth-last-child(even) { display: table-row; } |
+.c14 { float: left; } |
+.c14::first-letter { float: inherit; } |
+</style> |
+<div id="div" class="c14"> |
+ <div class="c3"> |
+ Test passes if it doesn't crash. |
+ </div> |
+</div> |
+<script> |
+test(function() { |
+ setTimeout('div.appendChild(document.createElement("div"));', 0); |
+ assert_true(true, "Should not crash"); |
+}, "Check that we clear pseudoElement from ElementRareData when FirstLetterPseudoElement doesn't have a LayoutObject"); |
+</script> |