1 files changed, 33 insertions, 0 deletions
diff --git a/testing/web-platform/tests/css/css-contain/content-visibility/slot-content-visibility-20-crash.html b/testing/web-platform/tests/css/css-contain/content-visibility/slot-content-visibility-20-crash.html
new file mode 100644
index 0000000000..a128f6a59d
--- /dev/null
+++ b/testing/web-platform/tests/css/css-contain/content-visibility/slot-content-visibility-20-crash.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<link rel=author href="mailto:jarhar@chromium.org">
+<link rel=help href="https://bugs.chromium.org/p/chromium/issues/detail?id=1268837">
+
+<style>
+summary {
+  margin: 1px 1px 1px -1px;
+}
+* {
+  max-height: 0vh;
+}
+</style>
+
+<script>
+function jsfuzzer() {
+  document.documentElement.appendChild(document.querySelector('details'));
+  document.execCommand("selectAll");
+  document.querySelector('li').replaceChild(
+    document.querySelector('q'),
+    document.querySelector('div'));
+  document.caretRangeFromPoint(127,487);
+}
+</script>
+
+<body onload=jsfuzzer()>
+
+<li>
+  <div></div>
+  <details>
+    <summary></summary>
+    <q></q>
+  </details>
+</li>