remove-reflection-crash.html | Explore in Territory

<!DOCTYPE html>

<html>
<head>
  <style>
    .box {
      width: 100px;
      height: 100px;
      background-color: blue;
    }
    
    #reflected {
      position: relative;
      z-index: 0;
      -webkit-box-reflect: below 10px;
    }
    
    .child {
      position: absolute;
      z-index: 1;
    }
  </style>
  <script>
    if (window.testRunner) {
      testRunner.waitUntilDone();
      testRunner.dumpAsText();
    }

    function doTest()
    {
      window.setTimeout(function() {
        var reflection = document.getElementById('reflected');
        var targetContainer = document.getElementById('container');
        targetContainer.appendChild(reflection);
        if (window.testRunner)
          testRunner.notifyDone();
      }, 0);
    }
    window.addEventListener('load', doTest, false);
  </script>
</head>
<body>
  <p>This test should not crash when run with MallocScribble enabled.</p>
  <div id="reflected" class="box">
    <div class="child box"></div>
  </div>
  <div id="container"></div>
</body>
</html>

chromium/third_party/blink/web_tests/fast/reflections/remove-reflection-crash.html