| <!DOCTYPE html> |
| <html> |
| <head> |
| <script> |
| if (window.testRunner) |
| testRunner.dumpAsText(); |
| |
| function crash() { |
| var firstBody = document.getElementById("firstBody"); |
| firstBody.removeChild(firstBody.firstChild); |
| firstBody.offsetTop; |
| } |
| |
| window.addEventListener("load", crash, false); |
| </script> |
| </head> |
| <body> |
| <p>Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=71246">71246</a>: REGRESSION(98738): Multiple crashes in the table rendering code</p> |
| <p>This test PASSES if it does not CRASH.</p> |
| <table style="table-layout:fixed; width:0;"> |
| <tbody id="firstBody"><tr></tr></tbody> |
| </table> |
| </body> |
| </html> |
