contain-nested-crash-002.html | Explore in Territory

<!DOCTYPE html>
<style>
html {
  -webkit-user-modify: read-write-plaintext-only
}

* {
  contain: strict;
}
</style>
<script>
function jsfuzzer() {
  htmlvar00014.appendChild(htmlvar00017);
}
</script>
<body onload=jsfuzzer()>
  <button>
    <span id="htmlvar00014"></span>
  </button>
  <span></span>
  <span>
    <button id="htmlvar00017"></button>
  </span>
</body>

chromium/third_party/blink/web_tests/wpt_internal/css/css-contain/crashtests/contain-nested-crash-002.html