LayoutTests/fast/dynamic/inline-to-block-crash.html - WebKit - Git at Google

 <script>

 // This tests a particular sequence of render tree changes, which
 // caused a crash in the code that maintains the line box tree.
 // Even small changes to the test make it no longer crash, so it
 // should be left as-is. That's why the test results don't say
 // anything about what this tests -- adding that caused the crash
 // to go away!

 function turnAnchorIntoBlock()
 {
     document.getElementById("a").style.display = "block";
     document.getElementById("span").firstChild.data = "PASSED";
     if (window.testRunner)
         testRunner.notifyDone();
 }

 function turnSpanIntoBlock()
 {
     document.body.offsetHeight; // trigger layout
     document.getElementById("span").style.display = "block";

     setTimeout(turnAnchorIntoBlock, 0);
 }

 function runTest()
 {
     if (window.testRunner) {
         testRunner.dumpAsText();
         testRunner.waitUntilDone();
     }
     setTimeout(turnSpanIntoBlock, 0);
 }

 </script>

 <body onload="runTest()">

 <a id="a">
     <span id="span">TEST HAS NOT RUN YET</span>
 </a>

 </body>
	<script>

	// This tests a particular sequence of render tree changes, which
	// caused a crash in the code that maintains the line box tree.
	// Even small changes to the test make it no longer crash, so it
	// should be left as-is. That's why the test results don't say
	// anything about what this tests -- adding that caused the crash
	// to go away!

	function turnAnchorIntoBlock()
	{
	document.getElementById("a").style.display = "block";
	document.getElementById("span").firstChild.data = "PASSED";
	if (window.testRunner)
	testRunner.notifyDone();
	}

	function turnSpanIntoBlock()
	{
	document.body.offsetHeight; // trigger layout
	document.getElementById("span").style.display = "block";

	setTimeout(turnAnchorIntoBlock, 0);
	}

	function runTest()
	{
	if (window.testRunner) {
	testRunner.dumpAsText();
	testRunner.waitUntilDone();
	}
	setTimeout(turnSpanIntoBlock, 0);
	}

	</script>

	<body onload="runTest()">

	<a id="a">
	<span id="span">TEST HAS NOT RUN YET</span>
	</a>

	</body>