input-image-content-crash.html (467B)
1 <!doctype html> 2 <title>Crash test: asynchronously applying image content to image input</title> 3 <link rel="author" href="mailto:yuzhehan@chromium.org" title="Yu Han"> 4 <link rel="help" href="https://crbug.com/1096002"> 5 <style> 6 .content { content: url(data:text/plain,aaa); } 7 </style> 8 <input id="input" type="image" class=content> 9 <script> 10 onload = ()=> { 11 document.body.offsetTop; 12 input.setAttribute('class', ''); 13 document.body.offsetTop; 14 } 15 </script>