web-platform-tests
diff --git a/‎html/semantics/forms/the-input-element/type-change-to-password-when-parent-has-spellcheck-attr-crash.html‎
Lines changed: 42 additions & 0 deletions b/‎html/semantics/forms/the-input-element/type-change-to-password-when-parent-has-spellcheck-attr-crash.html‎
Lines changed: 42 additions & 0 deletions
@@ -0,0 +1,42 @@
+<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+"use strict";
+
+addEventListener("DOMContentLoaded", async () => {
+  const iframe = document.querySelector("iframe");
+  for (let i = 0; i < 20; i++) {
+    const waitForLoad = new Promise(resolve => {
+      iframe.addEventListener("load", resolve, {once: true});
+    });
+    iframe.srcdoc =
+      `<style>` +
+      `input {` +
+      `  grid-column-end: line_name_0;` +
+      `  position: fixed !important;` +
+      `  inset: anchor(inside);` +
+      `}` +
+      `</style>` +
+      `<` + `script>` +
+      `addEventListener("DOMContentLoaded", () => {` +
+      `  focus();` +
+      `  const input = document.querySelector("input[type=number]");` +
+      `  document.documentElement.setAttribute("spellcheck", "false");` +
+      `  document.documentElement.style.display = "none";` +
+      `  document.documentElement.getBoundingClientRect();` +
+      `  document.documentElement.style.display = "";` +
+      `  input.setAttribute("type", "password");` +
+      `}, {once: true});` +
+      `</` + `script>` +
+      `<input type="number" value="63">`;
+    await waitForLoad;
+  }
+}, {once: true});
+</script>
+</head>
+<body>
+<iframe></iframe>
+</body>
+</html>