third_party/WebKit/LayoutTests/fast/table/table-caption-moved-crash.html

   1 <!DOCTYPE html>
   2 <style>
   3 .c15:nth-last-of-type(-n+6) { display: table; }
   4 </style>
   5 <script>
   6 if (window.testRunner)
   7     testRunner.dumpAsText();
   8
   9 function crash() {
  10     span = document.createElement('span');
  11     document.documentElement.appendChild(span);
  12     quote = document.createElement('q');
  13     quote.setAttribute('class', 'c15');
  14     document.documentElement.appendChild(quote);
  15     caption = document.createElement('caption');
  16     quote.appendChild(caption);
  17     span.offsetTop;
  18     span.appendChild(caption);
  19     span.offsetTop;
  20     span.innerHTML = "<a href='https://bugs.webkit.org/show_bug.cgi?id=95090'>Bug 95090</a>: Crash in LayoutTable::removeCaption<br/>This test PASSED as it did not crash.";
  21 }
  22 window.onload = crash;
  23 </script>