1 files changed, 21 insertions, 0 deletions
diff --git a/WebCore/manual-tests/select-delete-item.html b/WebCore/manual-tests/select-delete-item.html
new file mode 100644
index 0000000..43ca0c3
--- /dev/null
+++ b/WebCore/manual-tests/select-delete-item.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+    <title>RenderMenuList::itemStyle Select Element Crash</title>
+    <script>
+        function removeItem() {
+            var select = document.getElementById("dropDown");
+            select.removeChild(document.getElementsByTagName("option")[2]);
+        }
+    </script>
+</head>
+<body>
+    <select id="dropDown" onfocus="setTimeout('removeItem();', 2000);">
+        <option>Option 1</option>
+        <option>Option 2</option>
+        <option>Option 3</option>
+    </select>
+    <p>This is a test for bug <a href="http://webkit.org/b/34182">34182</a> Crash in WebKit!WebCore::RenderMenuList::itemStyle.
+    Once the select gets focus, in 2 seconds it will delete an item. This test passes
+    if you have the select open when it deletes an item, and doesn't crash.</p>
+</body>
+</html>