LayoutTests/fast/css/calc-with-two-variables-crash.html - WebKit - Git at Google

 <!DOCTYPE html>
 <html>
 <head>
 <script>
 if (window.testRunner)
     testRunner.dumpAsText();
 </script>
 <style>
 #test {
     --baseLength: 64px;
     --scaleFactor: 2;
     height: calc(var(--scaleFactor) * (var(--baseLength))); /* The extra parentheses around the second operand are necessary. */
     width: 128px;
     background-color: blue;
 }
 </style>
 </head>
 <body>
 <p>This test PASSED if it doesn't cause a crash, especially when run with Guard Malloc or MallocScribble enabled.</p>
 <div id="test"></div>
 <script>
 // Iterating at least 100 times seems to reliably reproduce the crash when run without Guard Malloc/MallocScribble enabled.
 for (var i = 0; i < 100; ++i) {
     var oldStyleElement = document.querySelector("style");
     var newStyleElement = document.createElement("style");
     newStyleElement.textContent = oldStyleElement.textContent;
     document.head.removeChild(oldStyleElement);
     document.head.appendChild(newStyleElement);
 }
 </script>
 </body>
 </html>
	<!DOCTYPE html>
	<html>
	<head>
	<script>
	if (window.testRunner)
	testRunner.dumpAsText();
	</script>
	<style>
	#test {
	--baseLength: 64px;
	--scaleFactor: 2;
	height: calc(var(--scaleFactor) * (var(--baseLength))); /* The extra parentheses around the second operand are necessary. */
	width: 128px;
	background-color: blue;
	}
	</style>
	</head>
	<body>
	<p>This test PASSED if it doesn't cause a crash, especially when run with Guard Malloc or MallocScribble enabled.</p>
	<div id="test"></div>
	<script>
	// Iterating at least 100 times seems to reliably reproduce the crash when run without Guard Malloc/MallocScribble enabled.
	for (var i = 0; i < 100; ++i) {
	var oldStyleElement = document.querySelector("style");
	var newStyleElement = document.createElement("style");
	newStyleElement.textContent = oldStyleElement.textContent;
	document.head.removeChild(oldStyleElement);
	document.head.appendChild(newStyleElement);
	}
	</script>
	</body>
	</html>