blob: 5eb33b86d420e9868fd7ad8d0bd8b07bda8462c4 [file] [log] [blame]
<!DOCTYPE html>
<html>
<body>
<p>Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=88676">88676</a>: Crash in FixedTableLayout::layout.</p>
<p id="console">FAILED, the test didn't run</p>
<script>
if (window.testRunner)
testRunner.dumpAsText();
var tableParts = [
"table-cell",
"table-row",
"table-row-group",
"table-column-group",
"table-caption"
];
var childTypes = [
"block",
"inline",
"table-cell",
"table-row",
"table-row-group",
"table-column-group",
"table-caption"
];
for (var i = 0; i < tableParts.length; ++i) {
for (var j = 0; j < childTypes.length; ++j) {
document.body.appendChild(document.createElement("pre")).appendChild(document.createTextNode("Prepending " + childTypes[j] + " to " + tableParts[i] + ":"));
var container = document.createElement("table");
container.style.tableLayout = "fixed";
container.width = "1";
var tablePart = document.createElement("div");
tablePart.style.display = tableParts[i];
container.appendChild(tablePart);
document.body.appendChild(container);
document.body.offsetTop;
var newChild = document.createElement("div");
newChild.style.display = childTypes[j];
container.insertBefore(newChild, tablePart);
document.body.offsetTop;
// The above should have the same render tree as you get when
// you do it all at once, like this:
document.body.appendChild(container.cloneNode(true));
document.body.offsetTop;
}
}
document.getElementById("console").innerHTML = "PASSED, the test didn't crash.";
</script>
</body>
</html>