34 lines
899 B
HTML
34 lines
899 B
HTML
<!DOCTYPE html>
|
|
<html>
|
|
Bug 101984: Heap-buffer-overflow in WebCore::RenderBlock::clone.<br />
|
|
Test passes if it does not crash.
|
|
<body>
|
|
<table>
|
|
<div class="container">
|
|
<div class="testClass" id="test1">
|
|
</div>
|
|
<div class="testClass">
|
|
<div>
|
|
<i id="test2"></i>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</table>
|
|
<script>
|
|
if (window.testRunner)
|
|
testRunner.dumpAsText();
|
|
|
|
document.head.appendChild(document.createElement("style"));
|
|
var styleSheet0 = document.styleSheets[0];
|
|
var test1 = document.getElementById("test1");
|
|
var test2 = document.getElementById("test2");
|
|
|
|
|
|
document.execCommand("SelectAll", true);
|
|
styleSheet0.insertRule('.testClass { -webkit-column-span: all ; }', 0);
|
|
test1.appendChild(test2);
|
|
styleSheet0.insertRule('.testClass::first-letter { border-style: none; }', 0);
|
|
styleSheet0.insertRule('.container { -webkit-column-axis: vertical; }', 0);
|
|
</script>
|
|
</body>
|
|
</html> |