third_party/WebKit/LayoutTests/fast/images/style-access-during-imageChanged-crash.html

   1 <style>
   2     @font-face {
   3       font-family: test;
   4       src: url(data:text/plain,1);
   5     }
   6 </style>
   7 <p>
   8     This test passes if it does not cause an assertion failure or a crash.
   9 </p>
  10 A <img id="target" alt="A">
  11 <script>
  12     function test()
  13     {
  14         document.body.offsetTop;
  15         document.body.style.fontFamily="test";
  16         document.body.offsetTop;
  17         document.getElementById("target").src = "data:text/plain,2";
  18     }
  19
  20     if (window.testRunner)
  21         testRunner.dumpAsText();
  22
  23     test();
  24 </script>