Bug 1858806 - Add crashtest r=RyanVM

Differential Revision: https://phabricator.services.mozilla.com/D214171
2024-06-18 23:39:38 +00:00 · 2024-06-18 23:39:38 +00:00 · 7f782f44d5
--- a/dom/svg/crashtests/1858806.html
+++ b/dom/svg/crashtests/1858806.html
@ -0,0 +1,22 @@
+<style>
+*:only-child {
+  display: contents;
+}
+</style>
+<script>
+function go() {
+  a.append(c)
+  document.dir = "rtl"
+  b.beginElement()
+  c.replaceChild(d, d)
+}
+</script>
+<body onload="go()">
+<svg>
+<text>
+<a id="a">
+</text>
+<animateMotion id="b">
+<h4>
+<fieldset id="c">
+<isindex id="d">
--- a/dom/svg/crashtests/crashtests.list
+++ b/dom/svg/crashtests/crashtests.list
@ -99,4 +99,5 @@ load 1683907.html
 pref(dom.svg.pathSeg.enabled,true) load 1715387.html
 load 1837487.html
 load 1858792.html
+load 1858806.html
 load 1861736.html