33 lines
974 B
HTML
33 lines
974 B
HTML
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<script>
|
|
if (window.testRunner)
|
|
testRunner.dumpAsText();
|
|
</script>
|
|
<style>
|
|
#test {
|
|
--baseLength: 64px;
|
|
--scaleFactor: 2;
|
|
height: calc(var(--scaleFactor) * (var(--baseLength))); /* The extra parentheses around the second operand are necessary. */
|
|
width: 128px;
|
|
background-color: blue;
|
|
}
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<p>This test PASSED if it doesn't cause a crash, especially when run with Guard Malloc or MallocScribble enabled.</p>
|
|
<div id="test"></div>
|
|
<script>
|
|
// Iterating at least 100 times seems to reliably reproduce the crash when run without Guard Malloc/MallocScribble enabled.
|
|
for (var i = 0; i < 100; ++i) {
|
|
var oldStyleElement = document.querySelector("style");
|
|
var newStyleElement = document.createElement("style");
|
|
newStyleElement.textContent = oldStyleElement.textContent;
|
|
document.head.removeChild(oldStyleElement);
|
|
document.head.appendChild(newStyleElement);
|
|
}
|
|
</script>
|
|
</body>
|
|
</html>
|