1 files changed, 15 insertions, 0 deletions
diff --git a/testing/web-platform/tests/css/css-text/text-autospace/crashtests/text-autospace-shape-cache-crash.html b/testing/web-platform/tests/css/css-text/text-autospace/crashtests/text-autospace-shape-cache-crash.html
new file mode 100644
index 0000000000..4c4360f5d1
--- /dev/null
+++ b/testing/web-platform/tests/css/css-text/text-autospace/crashtests/text-autospace-shape-cache-crash.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<span>る</span>
+<div>X</div>
+<div>X</div>
+<script>
+document.body.offsetHeight;
+const span = document.querySelector('span');
+const divs = Array.prototype.slice.call(document.querySelectorAll('div'));
+for (const e of divs) {
+  const n = span.cloneNode(span);
+  e.appendChild(n);
+  e.offsetHeight;
+}
+</script>