LayoutTests/fast/table/crash-beforeBorder-dirty-section.html - WebKit - Git at Google

 <!DOCTYPE html>
 <html>
 <head>
 <style>
     #el1 {
         border-collapse: collapse;
         -webkit-writing-mode: vertical-rl;
     }
 </style>
 </head>
 <body>
 <script>
     if (window.testRunner)
         testRunner.dumpAsText();

     var wrapper = document.createElement('div');
     wrapper.style.display = 'inline-block';
     document.body.appendChild(wrapper);
     var table = document.createElement('table');
     table.setAttribute('id', 'el1');
     wrapper.appendChild(table);
     tbody = document.createElement('tbody');
     tbody.setAttribute('id', 'el2');
     table.appendChild(tbody);

     function crash() {
         tbody.style.display = 'table';
         document.body.innerHTML = "<a href='https://bugs.webkit.org/show_bug.cgi?id=75215'>Bug 75215: Crash in RenderTable::borderBefore<a><br>This test has passed!";
     }

     window.addEventListener('load', crash, false);
 </script>
 </body>
 </html>
	<!DOCTYPE html>
	<html>
	<head>
	<style>
	#el1 {
	border-collapse: collapse;
	-webkit-writing-mode: vertical-rl;
	}
	</style>
	</head>
	<body>
	<script>
	if (window.testRunner)
	testRunner.dumpAsText();

	var wrapper = document.createElement('div');
	wrapper.style.display = 'inline-block';
	document.body.appendChild(wrapper);
	var table = document.createElement('table');
	table.setAttribute('id', 'el1');
	wrapper.appendChild(table);
	tbody = document.createElement('tbody');
	tbody.setAttribute('id', 'el2');
	table.appendChild(tbody);

	function crash() {
	tbody.style.display = 'table';
	document.body.innerHTML = "<a href='https://bugs.webkit.org/show_bug.cgi?id=75215'>Bug 75215: Crash in RenderTable::borderBefore<a><br>This test has passed!";
	}

	window.addEventListener('load', crash, false);
	</script>
	</body>
	</html>