| <!DOCTYPE html> |
| <html xmlns="http://www.w3.org/1999/xhtml"> |
| Test passes if it does not crash. |
| <head id="head1" style="-webkit-writing-mode: horizontal-bt;"></head> |
| <i id="i1"><button id="button1"></button></i> |
| <td id="td1"><body id="body2"></body></td> |
| <i id="i2"></i> |
| <style> |
| .class1 { float: left; } |
| </style> |
| <script> |
| if (window.testRunner) |
| testRunner.dumpAsText(); |
| |
| var docElement = document.documentElement; |
| |
| function crash() { |
| head1 = document.getElementById("head1"); |
| i1 = document.getElementById("i1"); |
| td1 = document.getElementById("td1"); |
| i2 = document.getElementById("i2"); |
| body2 = document.getElementById("body2"); |
| button1 = document.getElementById("button1"); |
| |
| // Makes it float and then intrude into anonymous block parent of i2. |
| button1.classList.toggle("class1"); |
| |
| // Moving td1, moves its body child. Body child inherits writing mode(bt) from head. |
| // And updating body's writing mode updates docElement's writing mode. |
| head1.appendChild(td1); |
| |
| docElement.offsetTop; |
| |
| head1.style.display = "list-item"; |
| |
| docElement.offsetTop; |
| |
| button1.classList.toggle("class1"); |
| } |
| document.addEventListener("DOMContentLoaded", crash, false); |
| </script> |
| </html> |
