third_party/WebKit/LayoutTests/fast/dynamic/continuation-detach-crash.html

   1 <!DOCTYPE html>
   2 <style>
   3     .class1 { -webkit-column-span: all; }
   4     .class2 > .class3 { float: right; content: open-quote; }
   5     .class3:last-of-type { -webkit-column-width: 1px; }
   6     .class3:nth-last-child(2n+10000000000000000) { -webkit-column-span: all;</style>
   7 <script>
   8 if (window.testRunner)
   9     testRunner.dumpAsText();
  10
  11 function crash() {
  12     test1 = document.createElement('header');
  13     test2 = document.createElement('footer');
  14     test3 = document.createElement('address');
  15     test3.setAttribute('class', 'class1');
  16     test1.appendChild(test3);
  17     test4 = document.createElement('nav');
  18     test4.setAttribute('class', 'class3');
  19     document.documentElement.appendChild(test4);
  20     test5 = document.createElement('dt');
  21     test5.setAttribute('class', 'class2');
  22     test6 = document.createElement('a');
  23     document.documentElement.appendChild(test6);
  24     test7 = document.createElement('div');
  25     test7.setAttribute('class', 'class3');
  26     test5.appendChild(test7);
  27     test5.appendChild(test1);
  28     test4.appendChild(test5);
  29     document.documentElement.offsetTop;
  30     test5.setAttribute('class', 'class3');
  31     document.documentElement.offsetTop;
  32     test2.appendChild(test6);
  33 }
  34 window.onload = crash;
  35 </script>
  36 <p><a href="https://bugs.webkit.org/show_bug.cgi?id=107189">Bug 107189</a>: Regression(r131539): Heap-use-after-free in WebCore::LayoutBlockFlow::willBeDestroyed</p>
  37 <p>This test has PASSED if it didn't CRASH.</p>