third_party/WebKit/LayoutTests/fast/css/counters/counter-traverse-object-crash.html

   1 <html>
   2     <script>
   3         function test()
   4         {
   5             if (window.testRunner)
   6                 testRunner.dumpAsText();
   7             document.getElementsByTagName("div")[0].outerHTML = "PASS";
   8         }
   9     </script>
  10     This tests that we do not crash when LayoutCounter traverses detached render trees.
  11     <body onload="test()" style="counter-increment: ctr">
  12         <object>
  13             <b style="counter-increment: ctr"><div></div></b>
  14             <menu style="counter-increment: ctr"></menu>
  15         </object>
  16     </body>
  17 </html>