blob: 2e7511e7844e821840238ae37ca352df8129dc95 [file] [log] [blame]
<!DOCTYPE html>
<html>
<head>
<style>
:after { display: table-cell; content: "Foo"; }
:first-child { display: table-cell; }
:before { display: table-column; content: "Bar"; }
</style>
<script type="text/javascript">
if (window.testRunner)
testRunner.dumpAsText();
function crash(event) {
newContent = document.createTextNode("Lorem Ipsum");
var divElement = document.createElement("div");
divElement.appendChild(newContent);
divElement.appendChild(document.createElement("div"));
document.getElementById("target").appendChild(divElement);
// For some reason, DRT dumps the <style> so remove it here to clean the dump.
var style = document.getElementsByTagName("style")[0];
style.parentNode.removeChild(style);
}
window.addEventListener("load", crash, false)
</script>
</head>
<body id="target">
<p>Test for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=89496">89496</a>: Crash in RenderTableSection::addCell.</p>
<p>This test passes if it doesn't CRASH or ASSERT.</p>
</body>
</html>