blob: f8174c008ec3fc122803866a236ca42f862328c7 [file] [log] [blame]
<!DOCTYPE html>
<style>
ruby:after {
display: block;
content: "";
}
</style>
<p>
Bug 106384: Heap-use-after-free in WebCore::RenderObject::willBeRemovedFromTree.
</p>
<script>
if (window.testRunner)
testRunner.dumpAsText();
onload = function() {
var ruby = document.createElement('ruby');
document.body.appendChild(ruby);
// Cause a layout.
document.body.offsetLeft;
ruby.appendChild(document.createTextNode('Passed if this test did not crash or assert.'));
};
</script>