36 lines
975 B
HTML
36 lines
975 B
HTML
<!DOCTYPE html>
|
|
<html>
|
|
WebKit Bug 89599 - Crash in RenderBlock::layoutPositionedObjects.<br />
|
|
Test passes if it does not crash.
|
|
<style>
|
|
table { position: relative; }
|
|
.span:last-child { position: relative; }
|
|
</style>
|
|
<script>
|
|
if (window.testRunner)
|
|
testRunner.dumpAsText();
|
|
|
|
function crash() {
|
|
table = document.createElement('table');
|
|
document.documentElement.appendChild(table);
|
|
|
|
span1 = document.createElement('span');
|
|
span2 = document.createElement('span');
|
|
span3 = document.createElement('span');
|
|
span3.setAttribute('class', 'span');
|
|
span4 = document.createElement('span');
|
|
span4.style.position = 'absolute';
|
|
span3.appendChild(span4);
|
|
|
|
table.appendChild(span1);
|
|
table.appendChild(span2);
|
|
table.appendChild(span3);
|
|
|
|
document.documentElement.offsetTop;
|
|
span2.style.display = 'table-header-group';
|
|
span3.style.display = 'block'
|
|
}
|
|
window.onload = crash;
|
|
</script>
|
|
</html>
|