third_party/WebKit/LayoutTests/fast/table/table-split-positioned-object-crash.html

   1 <!DOCTYPE html>
   2 <html>
   3 WebKit Bug 89599 - Crash in LayoutBlockFlow::layoutPositionedObjects.<br />
   4 Test passes if it does not crash.
   5 <style>
   6 table { position: relative; }
   7 .span:last-child { position: relative; }
   8 </style>
   9 <script>
  10 if (window.testRunner)
  11     testRunner.dumpAsText();
  12
  13 function crash() {
  14     table = document.createElement('table');
  15     document.documentElement.appendChild(table);
  16
  17     span1 = document.createElement('span');
  18     span2 = document.createElement('span');
  19     span3 = document.createElement('span');
  20     span3.setAttribute('class', 'span');
  21     span4 = document.createElement('span');
  22     span4.style.position = 'absolute';
  23     span3.appendChild(span4);
  24
  25     table.appendChild(span1);
  26     table.appendChild(span2);
  27     table.appendChild(span3);
  28
  29     document.documentElement.offsetTop;
  30     span2.style.display = 'table-header-group';
  31     span3.style.display = 'block'
  32 }
  33 window.onload = crash;
  34 </script>
  35 </html>