third_party/WebKit/LayoutTests/fast/multicol/recursive-split-flow-crash.html

   1 <!DOCTYPE html>
   2 <html>
   3 Bug 101984: Heap-buffer-overflow in WebCore::LayoutBlockFlow::clone.<br />
   4 Test passes if it does not crash.
   5 <body>
   6 <table>
   7 <div class="container">
   8 <div class="testClass" id="test1">
   9 </div>
  10 <div class="testClass">
  11 <div>
  12 <i id="test2"></i>
  13 </div>
  14 </div>
  15 </div>
  16 </table>
  17 <script>
  18 if (window.testRunner)
  19     testRunner.dumpAsText();
  20
  21 document.head.appendChild(document.createElement("style"));
  22 var styleSheet0 = document.styleSheets[0];
  23 var test1 = document.getElementById("test1");
  24 var test2 = document.getElementById("test2");
  25
  26
  27 document.execCommand("SelectAll", true);
  28 styleSheet0.insertRule('.testClass { -webkit-column-span: all ; }', 0);
  29 test1.appendChild(test2);
  30 styleSheet0.insertRule('.testClass::first-letter { border-style: none; }', 0);
  31 </script>
  32 </body>
  33 </html>