| <!DOCTYPE html> |
| <html> |
| <head> |
| <script> |
| if (window.testRunner) |
| testRunner.dumpAsText(); |
| </script> |
| <style> |
| #test { |
| --baseLength: 64px; |
| --scaleFactor: 2; |
| height: calc(var(--scaleFactor) * (var(--baseLength))); /* The extra parentheses around the second operand are necessary. */ |
| width: 128px; |
| background-color: blue; |
| } |
| </style> |
| </head> |
| <body> |
| <p>This test PASSED if it doesn't cause a crash, especially when run with Guard Malloc or MallocScribble enabled.</p> |
| <div id="test"></div> |
| <script> |
| // Iterating at least 100 times seems to reliably reproduce the crash when run without Guard Malloc/MallocScribble enabled. |
| for (var i = 0; i < 100; ++i) { |
| var oldStyleElement = document.querySelector("style"); |
| var newStyleElement = document.createElement("style"); |
| newStyleElement.textContent = oldStyleElement.textContent; |
| document.head.removeChild(oldStyleElement); |
| document.head.appendChild(newStyleElement); |
| } |
| </script> |
| </body> |
| </html> |
