Bug 1402157 - Part 2. A crash test for disassociating image loaders and frames.
MozReview-Commit-ID: I5w5w7x7fG2
new file mode 100644
--- /dev/null
+++ b/layout/style/crashtests/1402157.html
@@ -0,0 +1,20 @@
+<style>
+#b { mask-image: url(#b); }
+</style>
+<script>
+let triggered = false;
+function boom() {
+ document.body.appendChild(document.body.firstChild);
+ if (!triggered) {
+ triggered = true;
+ a.load();
+ history.replaceState('', '', '?foo');
+ }
+}
+</script>
+<body><sub id="b">
+ <audio id="a" src="foo" onerror="boom()"></audio>
+<option>
+</sub>
+<ul></ul>
+</body>
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@@ -227,16 +227,17 @@ load 1400325.html
load 1400926.html
load 1400936-1.html
load 1400936-2.html
load 1401256.html
load 1401692.html
load 1401706.html
load 1401801.html
load 1401825.html
+load 1402157.html
load 1402218-1.html
load 1402366.html
load 1402419.html
load 1402472.html
load 1403028.html
load 1403433.html
load 1403465.html
load 1403592.html
