third_party/WebKit/LayoutTests/fast/css/intruding-floats-crash.html

   1 <html>
   2 <head>
   3 <style>
   4     .c3 { text-decoration: inherit; border-style: dotted; }
   5     .c6:only-of-type { position: relative; content: url(data:text/plain,aaa); }
   6     .c6 + .c3 { display: table-row; float: right; }
   7     .c6[class^="c6"] { overflow: auto; }
   8     .c7:nth-last-of-type(odd) { float: right; width: 100%; }
   9     .c7:nth-last-child(2n) { display: -wap-marquee; float: none; }
  10     .c7[class$="c7"] { content: url(data:text/plain,aaa); }
  11     .c8 { display: compact; -webkit-column-count: 65536; }
  12     .c8:first-of-type { float: none; -webkit-column-span: all;}
  13 </style>
  14 <script>
  15 if (window.testRunner) {
  16     testRunner.waitUntilDone();
  17     testRunner.dumpAsText();
  18 }
  19
  20 var nodes = Array();
  21
  22 function tryToCrash()
  23 {
  24     document.body.OffsetTop;
  25     setTimeout('testRunner.notifyDone();',10);
  26 }
  27
  28 function boom() {
  29     try { nodes[8] = document.createElement('nav'); } catch(e) {}
  30     try { nodes[12] = document.createElement('ins'); } catch(e) {}
  31     try { nodes[48] = document.createElement('button'); } catch(e) {}
  32     try { document.documentElement.appendChild(nodes[48]); } catch(e) {}
  33     try { nodes[59] = document.createElement('sub'); } catch(e) {}
  34     try { nodes[59].setAttribute('class', 'c7'); } catch(e) {}
  35     try { document.documentElement.appendChild(nodes[59]); } catch(e) {}
  36     try { nodes[65] = document.createElement('b'); } catch(e) {}
  37     try { nodes[65].setAttribute('class', 'c6'); } catch(e) {}
  38     try { document.documentElement.appendChild(nodes[65]); } catch(e) {}
  39     try { nodes[66] = document.createElement('tbody'); } catch(e) {}
  40     try { nodes[66].setAttribute('class', 'c3'); } catch(e) {}
  41     try { document.documentElement.appendChild(nodes[66]); } catch(e) {}
  42     try { nodes[68] = document.createElement('button'); } catch(e) {}
  43     try { document.documentElement.appendChild(nodes[68]); } catch(e) {}
  44     try { nodes[77] = document.createElement('i'); } catch(e) {}
  45     try { document.documentElement.appendChild(nodes[77]); } catch(e) {}
  46     try { nodes[78] = document.createElement('aside'); } catch(e) {}
  47     try { document.documentElement.appendChild(nodes[78]); } catch(e) {}
  48     try { nodes[84] = document.createElement('nav'); } catch(e) {}
  49     try { nodes[84].setAttribute('class', 'c8'); } catch(e) {}
  50     try { nodes[86] = document.createElement('colgroup'); } catch(e) {}
  51     try { document.documentElement.appendChild(nodes[86]); } catch(e) {}
  52     setTimeout('try { nodes[12].appendChild(nodes[65]); } catch(e) {}', 5);
  53     setTimeout('try { nodes[8].appendChild(nodes[86]); } catch(e) {}', 4);
  54     setTimeout("try { nodes[68].setAttribute('class', 'c8'); } catch(e) {}", 2);
  55     setTimeout('try { nodes[68].appendChild(nodes[84]); } catch(e) {}', 3);
  56     setTimeout('document.execCommand("SelectAll", false, "");', 1);
  57     setTimeout('tryToCrash();', 6);
  58 }
  59     window.onload = boom;
  60 </script>
  61 </head>
  62 <body>
  63 Passes if it doesn't crash!
  64 </body>
  65 </html>