1 files changed, 37 insertions, 0 deletions
diff --git a/testing/web-platform/tests/css/css-flexbox/contain-size-layout-abspos-flex-container-crash.html b/testing/web-platform/tests/css/css-flexbox/contain-size-layout-abspos-flex-container-crash.html
new file mode 100644
index 0000000000..3197d5b796
--- /dev/null
+++ b/testing/web-platform/tests/css/css-flexbox/contain-size-layout-abspos-flex-container-crash.html
@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<html>
+  <meta charset="UTF-8">
+  <link rel="author" title="Ting-Yu Lin" href="mailto:tlin@mozilla.com">
+  <link rel="author" title="Mozilla" href="https://www.mozilla.org/">
+  <link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1678469">
+  <meta name="assert" content="This test ensures that the browser does not crash after removing the element 'c'.">
+
+  <style>
+  html { columns: 0 }
+  body {
+    transform: rotate(14deg);
+  }
+  #flex-container {
+    display: flex;
+    contain: size layout;
+    position: absolute;
+    width: 100px;
+    height: 100px;
+  }
+  </style>
+
+  <script>
+  function boom() {
+    let flex = document.getElementById('flex-container');
+    let c = document.getElementById('c');
+    flex.removeChild(c);
+  }
+  </script>
+
+  <body onload="boom()">
+    <div id="flex-container">
+      x
+      <div id="c"></div>
+    </div>
+  </body>
+</html>