third_party/WebKit/LayoutTests/fast/css-generated-content/bug-106384.html

   1 <!DOCTYPE html>
   2
   3 <style>
   4 ruby:after {
   5     display: block;
   6     content: "";
   7 }
   8 </style>
   9
  10 <p>
  11     Bug 106384: Heap-use-after-free in WebCore::LayoutObject::willBeRemovedFromTree.
  12 </p>
  13
  14 <script>
  15 if (window.testRunner)
  16     testRunner.dumpAsText();
  17
  18 onload = function() {
  19     var ruby = document.createElement('ruby');
  20     document.body.appendChild(ruby);
  21     // Cause a layout.
  22     document.body.offsetLeft;
  23     ruby.appendChild(document.createTextNode('Passed if this test did not crash or assert.'));
  24 };
  25 </script>