1 files changed, 194 insertions, 0 deletions
diff --git a/testing/web-platform/tests/css/CSS2/normal-flow/crashtests/block-in-inline-ax-crash.html b/testing/web-platform/tests/css/CSS2/normal-flow/crashtests/block-in-inline-ax-crash.html
new file mode 100644
index 0000000000..bbb484073a
--- /dev/null
+++ b/testing/web-platform/tests/css/CSS2/normal-flow/crashtests/block-in-inline-ax-crash.html
@@ -0,0 +1,194 @@
+<style type="text/css">
+</style><script type="text/javascript">
+var aoScriptElements = document.getElementsByTagName("script");
+for(var i = 0; i < aoScriptElements.length; i++) {
+  aoScriptElements[i].parentNode.removeChild(aoScriptElements[i]);
+}
+  var iCleanup = setInterval(function(){
+    var oe = document.getElementsByTagName("*");
+    for (var i = 0; i < oe.length; i++) {
+      var o = oe.item(i);
+      if (!o.firstElementChild && o != document.documentElement) {
+        var c =  p = o.parentNode;
+p.replaceChild(document.createTextNode("<"+o.tagName+">"+o.textContent+"</"+o.tagName+">"), o)
+      }
+    }
+  });
+function event_handler_EC9_load() {
+  var oElement = event.srcElement;
+oElement.insertAdjacentText('beforeend', 'G@82SSS#LLLLLLLLLLLL>[[[[[[[[[a{')
+oElement.textContent = '=jjjjjjr>sss(]]]]]]]]f$RRRRRR7qy'
+oElement.insertAdjacentText('afterend', '%=Qiiii/m`ppJ[MMMMMMMMMMMMMMM___')
+oElement.insertAdjacentElement('beforeend',function(){
+    return document.createElementNS('http://www.w3.org/2000/svg', 'a');
+  }())
+  var oSelection=window.getSelection();
+  var oRange = oSelection.rangeCount ? oSelection.getRangeAt(23 % oSelection.rangeCount) : null;
+    var oInsertedElement =function(){
+    var oNewElement = document.createElementNS('http://www.w3.org/2000/svg', 'cursor');
+    return oNewElement;
+  }();
+oRange.insertNode(oInsertedElement)
+}
+document.addEventListener("load", event_handler_EC9_load, { capture: true, once: true });
+function event_handler_ECA_DOMCharacterDataModified() {
+  var oElement = event.srcElement;
+    var oParent =function(){
+    var aoElements = document.getElementsByTagName("*");
+    if (aoElements.length) return aoElements[38 % aoElements.length];
+  }();
+      var oPreviousSibling = oParent.childNodes[31 % oParent.childNodes.length];
+oParent.insertBefore(oElement, oPreviousSibling)
+  var oSelection=window.getSelection();
+  var oSelectionElement =function(){
+    var aoElements = document.getElementsByTagName("*");
+    if (aoElements.length) return aoElements[49 % aoElements.length];
+  }();
+    try{oSelection.extend(oSelectionElement, oSelectionElement.textContent.length?48 % oSelectionElement.textContent.length:0)}
+      catch(e){}
+  var oRange = oSelection.rangeCount ? oSelection.getRangeAt(20 % oSelection.rangeCount) : null;
+var oDocumentFragment = oRange.extractContents()
+      var oParent =function(){
+    var aoElements = document.getElementsByTagName("*");
+    if (aoElements.length) return aoElements[20 % aoElements.length];
+  }();
+oParent.appendChild(oDocumentFragment)
+}
+document.addEventListener("DOMCharacterDataModified", event_handler_ECA_DOMCharacterDataModified);
+var event_handler_ECC_DOMNodeInsertedIntoDocument_active = false;
+var event_handler_ECC_DOMNodeInsertedIntoDocument_fired_count = 0;
+function event_handler_ECC_DOMNodeInsertedIntoDocument() {
+  if (event_handler_ECC_DOMNodeInsertedIntoDocument_active) return ;
+  event_handler_ECC_DOMNodeInsertedIntoDocument_fired_count++;
+  if (event_handler_ECC_DOMNodeInsertedIntoDocument_fired_count >= 20) return;
+  event_handler_ECC_DOMNodeInsertedIntoDocument_active = true;
+  var oElement = event.srcElement;
+oElement.outerHTML = ""
+  if (oElement.parentNode) {
+oElement.parentNode.replaceChild((function(){
+    var aoElements = document.getElementsByTagName("*");
+        return aoElements[27 % aoElements.length].cloneNode(true);
+  })(), oElement)
+  }
+  var oSelection=window.getSelection();
+  if (!oSelection.rangeCount) {
+  document.execCommand("SelectAll")
+  }
+  var oRange = oSelection.rangeCount ? oSelection.getRangeAt(82 % oSelection.rangeCount) : null;
+var oDocumentFragment = oRange.cloneContents()
+      var oParent =function(){
+    var aoElements = document.getElementsByTagName("*");
+    if (aoElements.length) return aoElements[23 % aoElements.length];
+  }();
+oParent.appendChild(oDocumentFragment)
+    var oInsertedElement =function(){
+    var aoElements = document.getElementsByTagName("*");
+    if (aoElements.length) return aoElements[20 % aoElements.length];
+  }();
+      try{oRange.insertNode(oInsertedElement)}
+  catch(e){}
+  event_handler_ECC_DOMNodeInsertedIntoDocument_active = false;
+}
+document.addEventListener("DOMNodeInsertedIntoDocument", event_handler_ECC_DOMNodeInsertedIntoDocument, true);
+setTimeout(function(){
+  var oElement =function(){
+    var aoElements = document.getElementsByTagName("*");
+    if (aoElements.length) return aoElements[20 % aoElements.length];
+  }();
+oElement.parentNode.replaceChild((function(){
+    return document.createElementNS('http://www.w3.org/2000/svg', 'vkern');
+  })(), oElement)
+  var oSelection=window.getSelection();
+  var oElement =function(){
+    var aoElements = document.getElementsByTagName("*");
+    if (aoElements.length) return aoElements[54 % aoElements.length];
+  }();
+oElement.normalize()
+  var oElement =function(){
+    var aoElements = document.getElementsByTagName("*");
+    if (aoElements.length) return aoElements[64 % aoElements.length];
+  }();
+oElement.insertAdjacentElement('afterend', document.createElementNS('http://www.w3.org/2000/svg', 'feComponentTransfer'))
+oSelection.modify('move', 'backward', 'word')
+  var oElement =function(){
+    var aoElements = document.getElementsByTagName("*");
+    if (aoElements.length) return aoElements[37 % aoElements.length];
+  }();
+oElement.parentNode.removeChild(oElement)
+  var oElement =function(){
+    var aoElements = document.getElementsByTagName("*");
+    if (aoElements.length) return aoElements[3 % aoElements.length];
+  }();
+    var oParent =function(){
+    var aoElements = document.getElementsByTagName("*");
+    if (aoElements.length) return aoElements[53 % aoElements.length];
+  }();
+      var oPreviousSibling = oParent.childNodes[69 % oParent.childNodes.length];
+oParent.insertBefore(oElement, oPreviousSibling)
+oParent.appendChild(oElement)
+});
+</script>
+<object "NAMEEB">
+<ruby="B A">
+<rb class="CLASS10 CLASS6" xml:space="preserve">
+<textarea classtabindex="-100">
+</textarea>
+<em class=>
+<select "ltr">
+<option class="CLASS12 CLASS6" ="disabled">
+</select>
+<button class="CLASS1 CLASS12"title="x">
+<blockquote class= xml:lang="nl">
+<div class>
+<form >
+<div ="preserve">
+</form>
+<table class="CLASS10"summary="AxBxC b">
+</table>
+c AxBxC
+<ruby class=>
+<rbc "preserve">
+<rb class="CLASS9" xml:lang="en, nl">
+<img class=xml:space="preserve"/>
+</rb>
+</div>
+<h1 class= title="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA b">
+<dfn class>
+</dfn>
+<form >
+<div "en, nl">
+<button class="CLASS9" ="ltr">
+</button>
+<select class="CLASS9 CLASS14"xml:lang="nl">
+</select>
+<select class= name="NAMEA2">
+</select>
+<div class>
+<textarea "0.5">
+</textarea>
+</div>
+<div class="CLASS7 CLASS13" ="A AxBxC">
+</div>
+<samp class="CLASS0 CLASS12"dir="ltr">
+<textarea class= rows="-1">
+</textarea>
+</samp>
+<ruby class>
+</ruby>
+<button "disabled">
+<div class="CLASS10 CLASS7" ="c A">
+<h6 class="CLASS3"xml:space="preserve">
+</h6>
+<div class=>
+<button "en, nl">
+<table class="CLASS14" ="1pt">
+<caption class="CLASS2" title="b">
+<col class/>
+<th "rowgroup">
+<th class="CLASS2 CLASS11" ="nl">
+<textarea class="CLASS12 CLASS10""en, nl">
+</textarea>
+</table>
+</button>
+</em>
+<select="NAMED1">