third_party/WebKit/LayoutTests/fast/table/split-table-no-section-update-crash.html

   1 <!DOCTYPE html>
   2 <html>
   3 <head>
   4 <style>
   5     :after { display: table-cell; content: "Foo"; }
   6     :first-child { display: table-cell; }
   7     :before { display: table-column; content: "Bar"; }
   8 </style>
   9 <script type="text/javascript">
  10 if (window.testRunner)
  11     testRunner.dumpAsText();
  12
  13 function crash(event) {
  14     newContent = document.createTextNode("Lorem Ipsum");
  15     var divElement = document.createElement("div");
  16     divElement.appendChild(newContent);
  17     divElement.appendChild(document.createElement("div"));
  18     document.getElementById("target").appendChild(divElement);
  19
  20     // For some reason, DRT dumps the <style> so remove it here to clean the dump.
  21     var style = document.getElementsByTagName("style")[0];
  22     style.parentNode.removeChild(style);
  23 }
  24
  25 window.addEventListener("load", crash, false)
  26 </script>
  27 </head>
  28 <body id="target">
  29 <p>Test for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=89496">89496</a>: Crash in LayoutTableSection::addCell.</p>
  30 <p>This test passes if it doesn't CRASH or ASSERT.</p>
  31 </body>
  32 </html>