crash-image-changed-during-layout.html

<!doctype HTML>
crbug.com/423891: Crashes if we remove a float from the
floating objects list during layout.
This test should not crash.
<style>
.c29 {
    src: url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAkAAAAJCAIAAABv85FHAAAABnRSTlMA/wAAAACkwsAdAAAAIUlEQVR4nGP4z8CAC+GUIEXuABhgkTuABEiRw2cmae4EAH05X7xDolNRAAAAAElFTkSuQmCC") format(attr(r));
    float: left;
    min-width: 30in;
    border-top: solid rgba(185, 191, 175, 0.254400) 66em;
    line-height: 30rem; shape-outside: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg'> fill='blue'/></svg>");
}
</style>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

var docElement = document.body;
function init() {
    fespotlight = document.createElementNS("http://www.w3.org/1999/xhtml", "fespotlight");
    fespotlight.setAttribute("class", "c29");
    docElement.appendChild(fespotlight);
    picture = document.createElementNS("http://www.w3.org/1999/xhtml", "picture");
    picture.setAttribute("class", "c29");
    docElement.appendChild(picture);
    text = document.createTextNode("If you see this that means the test has PASSED.");
    docElement.appendChild(text);
}
document.addEventListener("DOMContentLoaded", init, false);
</script>
chromium/third_party/blink/web_tests/http/tests/shapes/crash-image-changed-during-layout.html
