third_party/WebKit/LayoutTests/fast/table/split-anonymous-boxes-around-table-repaint-crash.html

   1 <!DOCTYPE html>
   2 <html>
   3 <style>
   4 .table {
   5     display: table;
   6     border-collapse: collapse;
   7 }
   8 .tableCell {
   9     display: table-cell;
  10 }
  11 .tableRowGroup {
  12     border-style: solid solid solid none;
  13     display: table-row-group;
  14 }
  15 </style>
  16 <body style="-webkit-writing-mode: vertical-rl;">
  17 <div class="table">
  18     A
  19     <span id="span1"></span>
  20     <span class="tableCell"></span>
  21 <div>
  22 </div>
  23 <div class="tableRowGroup">B</div>
  24 <script>
  25 if (window.testRunner)
  26     testRunner.dumpAsText();
  27
  28 document.body.offsetTop;
  29 span1.style.display = "table-footer-group";
  30
  31 document.body.offsetTop;
  32 document.body.innerHTML = "Bug <a href='https://bugs.webkit.org/show_bug.cgi?id=91160'>91160</a>: Crash in WebCore::LayoutTable::cellBefore<br>PASS. WebKit didn't crash";
  33 </script>
  34 </body>
  35 </html>