Adding upstream version 110.0.1.upstream/110.0.1upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 36 insertions, 0 deletions

diff --git a/testing/web-platform/tests/css/CSS2/floats-clear/clearance-containing-fragmented-float-crash.html b/testing/web-platform/tests/css/CSS2/floats-clear/clearance-containing-fragmented-float-crash.html
new file mode 100644
index 0000000000..3e62a52c30
--- /dev/null
+++ b/testing/web-platform/tests/css/CSS2/floats-clear/clearance-containing-fragmented-float-crash.html
@@ -0,0 +1,36 @@
+<!-- quirks mode -->
+<meta charset="utf-8">
+<title>Should not crash when a clearance frame having a fragmented float is discovered</title>
+<link rel="author" title="Ting-Yu Lin" href="mailto:tlin@mozilla.com">
+<link rel="author" title="Mozilla" href="https://www.mozilla.org/">
+<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1663232">
+
+<style>
+:not(em) {
+  border-left: 4px dashed green;
+  column-width: 0;
+}
+</style>
+<script>
+function go() {
+  b.appendChild(a)
+}
+</script>
+<m>
+<details ontoggle="go()" open>
+<f>
+<menu>U<menu>
+<table align="RIGHT">
+<caption>
+<o>
+<ul>
+<l>
+<li>
+<tr>6
+<table>
+<a>
+<details id="b" open>
+<summary>
+<i id="a">
+</summary>
+<details style="float: right">