Bug 1529149 - A crash test by fuzzing. r=boris

Depends on D47565 Differential Revision: https://phabricator.services.mozilla.com/D47566 --HG-- extra : moz-landing-system : lando
2019-09-30 19:49:32 +00:00 · 2019-09-30 19:49:32 +00:00 · 1940fb41d3
--- a/gfx/tests/crashtests/1529149.html
+++ b/gfx/tests/crashtests/1529149.html
@ -0,0 +1,23 @@
+<html class="reftest-wait">
+<style>
+:not(option) {
+  position: absolute;
+}
+#a {
+  background: url(data:image/gif;base64,R0lGODlhAQABAAD/ACwAAAAAAQABAAACADs=) fixed;
+}
+fieldset:first-child {
+  column-width: 0;
+  filter: invert(3);
+}
+</style>
+<script>
+function go() {
+  a.multiple = true
+  document.documentElement.classList.remove("reftest-wait");
+}
+</script>
+<body onload=go()>
+<fieldset style="scale: 1 9 0.3472">
+<select id="a">
+</html>
--- a/gfx/tests/crashtests/crashtests.list
+++ b/gfx/tests/crashtests/crashtests.list
@ -184,6 +184,7 @@ load 1509123.html
 load 1494062-blob-image-wraplist-clip.html
 load texture-allocator-zero-region.html
 load 1524418.html
+pref(layout.css.individual-transform.enabled,true) load 1529149.html
 load 1541113.html
 load 1535657.html
 load 1566206.html