Index: LayoutTests/fast/shapes/crash-caused-by-dirtying-a-shape-while-computing-it-requires-a-long-filename-to-crash.html |
diff --git a/LayoutTests/fast/shapes/crash-caused-by-dirtying-a-shape-while-computing-it-requires-a-long-filename-to-crash.html b/LayoutTests/fast/shapes/crash-caused-by-dirtying-a-shape-while-computing-it-requires-a-long-filename-to-crash.html |
new file mode 100644 |
index 0000000000000000000000000000000000000000..ed28210234681ec5171e0070d7e84c538f8aef40 |
--- /dev/null |
+++ b/LayoutTests/fast/shapes/crash-caused-by-dirtying-a-shape-while-computing-it-requires-a-long-filename-to-crash.html |
@@ -0,0 +1,20 @@ |
+<!doctype HTML> |
+<div id=start><br><br></div> |
+<div id=end></div> |
+<script> |
+ if (window.testRunner) { |
+ testRunner.waitUntilDone(); |
+ testRunner.dumpAsText(); |
+ } |
+ // crbug.com/409508: Crashes if we attempt to delete a node in the interval tree of floats while traversing it. |
+ var selection = window.getSelection(); |
+ selection.setBaseAndExtent(start, 0, end, end.childNodes.length); |
+ if (window.testRunner) |
+ testRunner.notifyDone(); |
+</script> |
+<style> |
+div,br { |
+ shape-outside: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg'></svg>"); |
+ float: left; |
+} |
+</style> |