layout/painting/crashtests/1430589-1.html

<html class="reftest-wait"><head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
  <style>
    :root {
      flex-wrap: wrap-reverse;
    }
    menuitem {
      -webkit-mask-image: url(data:image/gif;base64,R0lGODlhEAAQAMQAAORHHOVSKudfOulrSOp3WOyDZu6QdvCchPGolfO0o/XBs/fNwfjZ0frl3/zy7////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAkAABAALAAAAAAQABAAAAVVICSOZGlCQAosJ6mu7fiyZeKqNKToQGDsM8hBADgUXoGAiqhSvp5QAnQKGIgUhwFUYLCVDFCrKUE1lBavAViFIDlTImbKC5Gm2hB0SlBCBMQiB0UjIQA7);
    }

    * {
      margin-right: -1px;
      display: -webkit-box;
      overflow: scroll;
    }


    .css1 {
      -webkit-border-bottom-left-radius: 10px;
    }


  </style>
<script>
function BOOM(){
  setTimeout(() => {
    var elem = document.getElementById("vuln");
    elem.style.width = 600;
    elem.style.height = 600;
    window.requestAnimationFrame(() => {
      window.requestAnimationFrame(() => {
        document.documentElement.removeAttribute("class");
      });
    });
  }, 0);
}

document.addEventListener("MozReftestInvalidate", BOOM);
//window.addEventListener("load", BOOM);
</script></head>

<body>
  <footer>
      <textarea id="vuln" style="width: 500px; height: 500px;">Ashitaka</textarea>
  </footer>
  <menu>
    <menuitem>
      <iframe></iframe>
  </menuitem></menu>
  <menuitem>
  <hr>
  <dialog class="css1"></dialog>


</menuitem></body></html>