Add a wpt crashtest for removing a child under a flex container with …

…size and layout containment. bug 1679819 fixed this crash by preventing a "contain:size" element from being fragmented. Differential Revision: https://phabricator.services.mozilla.com/D98228 bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1678469 gecko-commit: b015eacef37741beea4d8c18a635f4ae288d5a5f gecko-reviewers: emilio
web-platform-tests · Dec 1, 2020 · 5a91bd0 · 5a91bd0
1 parent 2ece71c
commit 5a91bd0
Showing 1 changed file with 37 additions and 0 deletions.
diff --git a/css/css-flexbox/contain-size-layout-abspos-flex-container-crash.html b/css/css-flexbox/contain-size-layout-abspos-flex-container-crash.html
@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<html>
+  <meta charset="UTF-8">
+  <link rel="author" title="Ting-Yu Lin" href="mailto:tlin@mozilla.com">
+  <link rel="author" title="Mozilla" href="https://www.mozilla.org/">
+  <link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1678469">
+  <meta name="assert" content="This test ensures that the browser does not crash after removing the element 'c'.">
+
+  <style>
+  html { columns: 0 }
+  body {
+    transform: rotate(14deg);
+  }
+  #flex-container {
+    display: flex;
+    contain: size layout;
+    position: absolute;
+    width: 100px;
+    height: 100px;
+  }
+  </style>
+
+  <script>
+  function boom() {
+    let flex = document.getElementById('flex-container');
+    let c = document.getElementById('c');
+    flex.removeChild(c);
+  }
+  </script>
+
+  <body onload="boom()">
+    <div id="flex-container">
+      x
+      <div id="c"></div>
+    </div>
+  </body>
+</html>