summaryrefslogtreecommitdiffstats
path: root/layout/base
diff options
context:
space:
mode:
Diffstat (limited to 'layout/base')
-rw-r--r--layout/base/crashtests/1404789-1.html16
-rw-r--r--layout/base/crashtests/1404789-2.html2
-rw-r--r--layout/base/crashtests/crashtests.list2
3 files changed, 20 insertions, 0 deletions
diff --git a/layout/base/crashtests/1404789-1.html b/layout/base/crashtests/1404789-1.html
new file mode 100644
index 000000000..bd577ae24
--- /dev/null
+++ b/layout/base/crashtests/1404789-1.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<script>
+ // Test for content redistribution outside of the document.
+ // Passes if it doesn't assert.
+ let host = document.createElement('div');
+ host.innerHTML = "<div id='foo'></div>";
+
+ let shadowRoot = host.createShadowRoot();
+ shadowRoot.innerHTML = "<content select='#foo'></content>";
+
+ host.firstElementChild.removeAttribute('id');
+
+ // Move to the document, do the same.
+ document.documentElement.appendChild(host);
+ host.firstElementChild.setAttribute('id', 'foo');
+</script>
diff --git a/layout/base/crashtests/1404789-2.html b/layout/base/crashtests/1404789-2.html
new file mode 100644
index 000000000..667618141
--- /dev/null
+++ b/layout/base/crashtests/1404789-2.html
@@ -0,0 +1,2 @@
+<!doctype html>
+<iframe style="display: none" src="1404789-1.html"></iframe>
diff --git a/layout/base/crashtests/crashtests.list b/layout/base/crashtests/crashtests.list
index 6ded4ff3f..66dc35ebc 100644
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -483,3 +483,5 @@ load 1308793.svg
load 1308848-1.html
load 1308848-2.html
asserts(0-1) load 1343606.html # bug 1343948
+load 1404789-1.html
+load 1404789-2.html