<!DOCTYPE html>
<html>
<body>
    <p>Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=88676">88676</a>: Crash in FixedTableLayout::layout.</p>
    <p id="console">FAILED, the test didn't run</p>
    <script>
        if (window.testRunner)
            testRunner.dumpAsText();

        var tableParts = [
            "table-cell",
            "table-row",
            "table-row-group",
            "table-column-group",
            "table-caption"
        ];

        var childTypes = [
            "block",
            "inline",
            "table-cell",
            "table-row",
            "table-row-group",
            "table-column-group",
            "table-caption"
        ];

        for (var i = 0; i < tableParts.length; ++i) {
            for (var j = 0; j < childTypes.length; ++j) {
                document.body.appendChild(document.createElement("pre")).appendChild(document.createTextNode("Prepending " + childTypes[j] + " to " + tableParts[i] + ":"));
                var container = document.createElement("table");
                container.style.tableLayout = "fixed";
                container.width = "1";
                var tablePart = document.createElement("div");
                tablePart.style.display = tableParts[i];
                container.appendChild(tablePart);
                document.body.appendChild(container);
                document.body.offsetTop;
                var newChild = document.createElement("div");
                newChild.style.display = childTypes[j];
                container.insertBefore(newChild, tablePart);
                document.body.offsetTop;
                // The above should have the same render tree as you get when
                // you do it all at once, like this:
                document.body.appendChild(container.cloneNode(true));
                document.body.offsetTop;
            }
        }

        document.getElementById("console").innerHTML = "PASSED, the test didn't crash.";
    </script>
</body>
</html>