third_party/WebKit/LayoutTests/fast/css-generated-content/first-letter-next-sibling-crash.html

   1 <!DOCTYPE html>
   2 <html>
   3 <style>
   4 .absolutePosition { position: fixed; }
   5 .float:before { float: right; content: ''; }
   6 .float:first-letter { float: right; }
   7 .inline::first-letter { content: ''; }
   8 </style>
   9 <script>
  10 if (window.testRunner)
  11     testRunner.dumpAsText();
  12
  13 function startTest() {
  14     document.body.offsetTop;
  15     var parent = document.getElementById("parent");
  16     var child = document.getElementById("child");
  17     child.setAttribute('class', 'inline');
  18     document.body.offsetTop;
  19     parent.removeChild(child);
  20     document.body.offsetTop;
  21     parent.setAttribute('class', 'inline');
  22 }
  23 window.onload = startTest;
  24 </script>
  25 WebKit Bug 85759 - Crash in LayoutBlockFlow::updateFirstLetterStyle.
  26 <div class="float" id="parent">
  27 <div class="absolutePosition" id="child"></div>
  28 PASS if test does not crash.
  29 </div>
  30 </html>