third_party/WebKit/LayoutTests/fast/block/float/intruding-float-not-removed-writing-mode.xhtml

   1 <!DOCTYPE html>
   2 <html xmlns="http://www.w3.org/1999/xhtml">
   3 Test passes if it does not crash.
   4 <head id="head1" style="-webkit-writing-mode: horizontal-bt;"></head>
   5 <i id="i1"><button id="button1"></button></i>
   6 <td id="td1"><body id="body2"></body></td>
   7 <i id="i2"></i>
   8 <style>
   9 .class1 { float: left; }
  10 </style>
  11 <script>
  12 if (window.testRunner)
  13     testRunner.dumpAsText();
  14
  15 var docElement = document.documentElement;
  16
  17 function crash() {
  18     head1 = document.getElementById("head1");
  19     i1 = document.getElementById("i1");
  20     td1 = document.getElementById("td1");
  21     i2 = document.getElementById("i2");
  22     body2 = document.getElementById("body2");
  23     button1 = document.getElementById("button1");
  24
  25     // Makes it float and then intrude into anonymous block parent of i2.
  26     button1.classList.toggle("class1");
  27
  28     // Moving td1, moves its body child. Body child inherits writing mode(bt) from head.
  29     // And updating body's writing mode updates docElement's writing mode.
  30     head1.appendChild(td1);
  31
  32     docElement.offsetTop;
  33
  34     head1.style.display = "list-item";
  35
  36     docElement.offsetTop;
  37
  38     button1.classList.toggle("class1");
  39 }
  40 document.addEventListener("DOMContentLoaded", crash, false);
  41 </script>
  42 </html>