| <!DOCTYPE html> |
| <style> |
| html, body, button { all: inherit; } |
| .resizer::-webkit-resizer { text-anchor: end; } |
| .resize { resize: horizontal; } |
| </style> |
| |
| <script> |
| if (window.testRunner) |
| testRunner.dumpAsText(); |
| |
| function crash() { |
| outer_button.addEventListener("DOMNodeRemoved", function () { |
| outer_button.removeAttribute("class"); |
| }, false); |
| |
| outer_button.appendChild(inner_button); |
| outer_button.classList.toggle("resizer"); |
| outer_button.classList.add("resize"); |
| |
| window.scrollBy(54, 49); |
| inner_button.style.display = "table-row-group" |
| |
| var svg = document.implementation.createDocument("http://www.w3.org/2000/svg", "svg", null); |
| svg.documentElement.appendChild(input); |
| |
| window.scrollBy(11, 81); |
| |
| inner_button.parentNode.removeChild(inner_button); |
| } |
| document.addEventListener("DOMContentLoaded", crash, false); |
| </script> |
| |
| <button id='outer_button'> |
| Test passes if it does not crash. |
| <input id='input'> |
| <button id='inner_button'></button> |
| </input> |
| </button> |
