38 lines
1.4 KiB
HTML
38 lines
1.4 KiB
HTML
<!DOCTYPE html>
|
|
<style>
|
|
.class1 { -webkit-column-span: all; }
|
|
.class2 > .class3 { float: right; content: open-quote; }
|
|
.class3:last-of-type { -webkit-column-width: 1px; }
|
|
.class3:nth-last-child(2n+10000000000000000) { -webkit-column-span: all;</style>
|
|
<script>
|
|
if (window.testRunner)
|
|
testRunner.dumpAsText();
|
|
|
|
function crash() {
|
|
test1 = document.createElement('header');
|
|
test2 = document.createElement('footer');
|
|
test3 = document.createElement('address');
|
|
test3.setAttribute('class', 'class1');
|
|
test1.appendChild(test3);
|
|
test4 = document.createElement('nav');
|
|
test4.setAttribute('class', 'class3');
|
|
document.documentElement.appendChild(test4);
|
|
test5 = document.createElement('dt');
|
|
test5.setAttribute('class', 'class2');
|
|
test6 = document.createElement('a');
|
|
document.documentElement.appendChild(test6);
|
|
test7 = document.createElement('div');
|
|
test7.setAttribute('class', 'class3');
|
|
test5.appendChild(test7);
|
|
test5.appendChild(test1);
|
|
test4.appendChild(test5);
|
|
document.documentElement.offsetTop;
|
|
test5.setAttribute('class', 'class3');
|
|
document.documentElement.offsetTop;
|
|
test2.appendChild(test6);
|
|
}
|
|
window.onload = crash;
|
|
</script>
|
|
<p><a href="https://bugs.webkit.org/show_bug.cgi?id=107189">Bug 107189</a>: Regression(r131539): Heap-use-after-free in WebCore::RenderBlock::willBeDestroyed</p>
|
|
<p>This test has PASSED if it didn't CRASH.</p>
|