summaryrefslogtreecommitdiffstats
path: root/layout/svg/crashtests/1755770-2.html
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--layout/svg/crashtests/1755770-2.html19
1 files changed, 19 insertions, 0 deletions
diff --git a/layout/svg/crashtests/1755770-2.html b/layout/svg/crashtests/1755770-2.html
new file mode 100644
index 0000000000..31b42ec452
--- /dev/null
+++ b/layout/svg/crashtests/1755770-2.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <script>
+ window.addEventListener("load", () => {
+ const svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+ const text = document.createElementNS("http://www.w3.org/2000/svg", "text");
+ text.setAttribute("letter-spacing", "65535pc");
+ text.setAttribute("writing-mode", "vertical-lr");
+ const node = document.createTextNode("\rï¿»ð¨\nó = ð£%?;ð©á©¿ð�");
+ text.appendChild(node);
+ svg.appendChild(text);
+ document.documentElement.appendChild(svg);
+ const rect = new DOMRectReadOnly(-128, 256, 0, 1024);
+ node.convertRectFromNode(rect, document, {});
+ })
+ </script>
+</head>
+</html>