| <!DOCTYPE html> | |
| <html> | |
| Bug 101984: Heap-buffer-overflow in WebCore::RenderBlock::clone.<br /> | |
| Test passes if it does not crash. | |
| <body> | |
| <table> | |
| <div class="container"> | |
| <div class="testClass" id="test1"> | |
| </div> | |
| <div class="testClass"> | |
| <div> | |
| <i id="test2"></i> | |
| </div> | |
| </div> | |
| </div> | |
| </table> | |
| <script> | |
| if (window.testRunner) | |
| testRunner.dumpAsText(); | |
| document.head.appendChild(document.createElement("style")); | |
| var styleSheet0 = document.styleSheets[0]; | |
| var test1 = document.getElementById("test1"); | |
| var test2 = document.getElementById("test2"); | |
| document.execCommand("SelectAll", true); | |
| styleSheet0.insertRule('.testClass { -webkit-column-span: all ; }', 0); | |
| test1.appendChild(test2); | |
| styleSheet0.insertRule('.testClass::first-letter { border-style: none; }', 0); | |
| styleSheet0.insertRule('.container { -webkit-column-axis: vertical; }', 0); | |
| </script> | |
| </body> | |
| </html> |