third_party/WebKit/LayoutTests/fast/table/crash-splitColumn.html

   1 <!DOCTYPE html>
   2 <html>
   3 <head>
   4 <style>
   5 .lastTableHeaderGroup:last-of-type { display: table-header-group; }</style>
   6 </style>
   7 <script>
   8 if (window.testRunner) {
   9     testRunner.dumpAsText();
  10     testRunner.waitUntilDone();
  11 }
  12
  13 function crash()
  14 {
  15     rubyTag.appendChild(lastTableHead);
  16     if (window.testRunner)
  17         testRunner.notifyDone();
  18 }
  19
  20 function insertNodes() {
  21     var tableHead = document.createElement('th');
  22     tableHead.setAttribute('colspan', '5');
  23     tableHead.setAttribute('class', 'lastTableHeaderGroup');
  24     document.documentElement.appendChild(tableHead);
  25     tableHead.appendChild(document.createElement('p'));
  26     lastTableHead = document.createElement('th');
  27     document.documentElement.appendChild(lastTableHead);
  28     rubyTag = document.createElement('rt');
  29     setTimeout(crash, 0);
  30 }
  31 window.addEventListener("load", insertNodes, false);
  32 </script>
  33 </head>
  34 <body>
  35 <p> Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=70171">70171</a>: Crash in LayoutTableSection::splitColumn</p>
  36 <p> This test PASSES if it does not CRASH or ASSERT.</p>
  37 </body>
  38 </html>