summaryrefslogtreecommitdiffstats
path: root/testing/web-platform/tests/css/css-contain/content-visibility/slot-content-visibility-20-crash.html
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-07 19:33:14 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-07 19:33:14 +0000
commit36d22d82aa202bb199967e9512281e9a53db42c9 (patch)
tree105e8c98ddea1c1e4784a60a5a6410fa416be2de /testing/web-platform/tests/css/css-contain/content-visibility/slot-content-visibility-20-crash.html
parentInitial commit. (diff)
downloadfirefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.tar.xz
firefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.zip
Adding upstream version 115.7.0esr.upstream/115.7.0esr
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'testing/web-platform/tests/css/css-contain/content-visibility/slot-content-visibility-20-crash.html')
-rw-r--r--testing/web-platform/tests/css/css-contain/content-visibility/slot-content-visibility-20-crash.html33
1 files changed, 33 insertions, 0 deletions
diff --git a/testing/web-platform/tests/css/css-contain/content-visibility/slot-content-visibility-20-crash.html b/testing/web-platform/tests/css/css-contain/content-visibility/slot-content-visibility-20-crash.html
new file mode 100644
index 0000000000..a128f6a59d
--- /dev/null
+++ b/testing/web-platform/tests/css/css-contain/content-visibility/slot-content-visibility-20-crash.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<link rel=author href="mailto:jarhar@chromium.org">
+<link rel=help href="https://bugs.chromium.org/p/chromium/issues/detail?id=1268837">
+
+<style>
+summary {
+ margin: 1px 1px 1px -1px;
+}
+* {
+ max-height: 0vh;
+}
+</style>
+
+<script>
+function jsfuzzer() {
+ document.documentElement.appendChild(document.querySelector('details'));
+ document.execCommand("selectAll");
+ document.querySelector('li').replaceChild(
+ document.querySelector('q'),
+ document.querySelector('div'));
+ document.caretRangeFromPoint(127,487);
+}
+</script>
+
+<body onload=jsfuzzer()>
+
+<li>
+ <div></div>
+ <details>
+ <summary></summary>
+ <q></q>
+ </details>
+</li>