| <!DOCTYPE html> |
| <html> |
| Bug 101970: Heap-use-after-free in WebCore::RenderLayerModelObject::hasSelfPaintingLayer<br /> |
| Test passes if it does not crash.<br /> |
| <div id="container"> |
| <q> |
| <q id="test1"></q> |
| </q> |
| <q id="test2"> |
| <q style="float: left"></q> |
| <q id="test3"> |
| <q style="position: fixed;"> |
| </q> |
| </q> |
| </div> |
| <script> |
| if (window.testRunner) |
| testRunner.dumpAsText(); |
| |
| document.body.offsetTop; |
| test3.style.display = "table-footer-group"; |
| test3.focus(); |
| test1.style.display = "table-row-group"; |
| test2.style.display = "inline-block"; |
| </script> |
| </html> |
