33 lines
1.0 KiB
HTML
33 lines
1.0 KiB
HTML
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<style>
|
|
:after { display: table-cell; content: "Foo"; }
|
|
:first-child { display: table-cell; }
|
|
:before { display: table-column; content: "Bar"; }
|
|
</style>
|
|
<script type="text/javascript">
|
|
if (window.testRunner)
|
|
testRunner.dumpAsText();
|
|
|
|
function crash(event) {
|
|
newContent = document.createTextNode("Lorem Ipsum");
|
|
var divElement = document.createElement("div");
|
|
divElement.appendChild(newContent);
|
|
divElement.appendChild(document.createElement("div"));
|
|
document.getElementById("target").appendChild(divElement);
|
|
|
|
// For some reason, DRT dumps the <style> so remove it here to clean the dump.
|
|
var style = document.getElementsByTagName("style")[0];
|
|
style.parentNode.removeChild(style);
|
|
}
|
|
|
|
window.addEventListener("load", crash, false)
|
|
</script>
|
|
</head>
|
|
<body id="target">
|
|
<p>Test for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=89496">89496</a>: Crash in RenderTableSection::addCell.</p>
|
|
<p>This test passes if it doesn't CRASH or ASSERT.</p>
|
|
</body>
|
|
</html>
|