third_party/WebKit/LayoutTests/fast/block/float/intruding-float-not-removed-from-next-sibling-crash.html

   1 <html>
   2 <head>
   3 <style>
   4 #float1 {
   5     float: left;
   6 }
   7 #div1 {
   8     display: table;
   9     padding-top: 1em;
  10     padding-bottom: 1em;
  11     margin-bottom: 1em;
  12     -webkit-margin-before: -100px;
  13 }
  14 </style>
  15 <script>
  16 if (window.testRunner)
  17     testRunner.dumpAsText();
  18
  19 onload = function() {
  20 document.body.appendChild(document.createElement('select'));
  21
  22 float1 = document.createElement('hr');
  23 float1.setAttribute('id', 'float1');
  24 document.body.appendChild(float1);
  25
  26 div1 = document.createElement('div');
  27 div1.setAttribute('id', 'div1');
  28 document.body.appendChild(div1);
  29 div1.appendChild(document.createElement('textarea'));
  30
  31 div2 = document.createElement('div');
  32 document.body.appendChild(div2);
  33 div2.appendChild(document.createElement('input'));
  34
  35 document.body.offsetTop;
  36 document.body.removeChild(float1);
  37 document.body.offsetTop;
  38 document.body.innerHTML = "PASS. WebKit didn't crash.";
  39 }
  40 </script>
  41 </head>
  42 <body>
  43 </body>
  44 </html>