blob: 1e30b934e69888ddf8fa818faa0314374bd26810 [file] [log] [blame]
<style>
.c3 { position: fixed; }
.c12:first-letter { visibility: inherit; }
.c12 { -webkit-appearance: button; }
.c13 { display: table-row; }
.c13:nth-last-child(odd) { height: 80%; }
</style>
<script>
if (window.testRunner)
testRunner.dumpAsText();
function boom() {
var quote = document.createElement('q');
document.documentElement.appendChild(quote);
base = document.createElement('base');
base2 = document.createElement('base');
base2.setAttribute('class', 'c3');
quote.appendChild(base2);
var ins = document.createElement('ins');
base2.appendChild(ins);
var sub = document.createElement('sub');
var quote3 = document.createElement('q');
quote3.setAttribute('class', 'c12');
sub.appendChild(quote3);
figureRow = document.createElement('figure');
figureRow.setAttribute('class', 'c13');
document.documentElement.appendChild(figureRow);
var col = document.createElement('col');
col.setAttribute('class', 'c13');
document.documentElement.appendChild(col);
var select = document.createElement('select');
document.documentElement.appendChild(select);
code = document.createElement('code');
document.documentElement.appendChild(code);
quote2 = document.createElement('q');
setTimeout('quote2.appendChild(code);', 321);
ins.appendChild(sub);
setTimeout('base.appendChild(figureRow);', 251);
text = document.createTextNode('-1435037881');
setTimeout('figureRow.appendChild(text);', 206);
}
window.onload = boom;
</script>
<p>Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=76842">76842</a>: Crash in WebCore::RenderTableSection::rowLogicalHeightChanged</p>
<p>This test passes if it does not crash nor ASSERT.</p>