LayoutTests/tables/table-section-overflow-clip-crash.html - WebKit - Git at Google

 <!DOCTYPE html>
 <html>
 <head>
 <style>
 #test0 {
     counter-reset: c;
 }
 #test0::after {
     content: counter(c);
     counter-reset: c;
 }
 #test1::after {
     content: counter(c);
     counter-reset: c;
 }
 #test2 {
     counter-reset: c;
     height: 1px;
     width: 1px;
     overflow-x: scroll;
     -webkit-perspective: 1;
 }
 #test3 {
     content: counter(c);
     -webkit-animation-name: a;
     -webkit-animation-duration: 0.01s;
 }
 </style>
 <script>
 if (window.testRunner) {
     testRunner.dumpAsText();
     testRunner.waitUntilDone();
 }

 function finish() {
     document.body.innerHTML = "WebKit Bug 87445 - RenderTableSection::paintCell.<br/>Test passes if it does not crash.";
     if (window.testRunner)
         testRunner.notifyDone();
 }

 onload = function() {
     test0 = document.createElement('div');
     test0.setAttribute('id', 'test0');
     document.body.appendChild(test0);
     test1 = document.createElement('div');
     test1.setAttribute('id', 'test1');
     test0.appendChild(test1);
     test2 = document.createElement('div');
     test2.setAttribute('id', 'test2');
     test1.appendChild(test2);
     test3 = document.createElement('div');
     test3.setAttribute('id', 'test3');
     test2.appendChild(test3);
     test2.style.display = 'table-footer-group';
     document.body.offsetTop;
     setTimeout("finish()", 10);
 }
 </script>
 </head>
 <body>
 </body>
 </html>
	<!DOCTYPE html>
	<html>
	<head>
	<style>
	#test0 {
	counter-reset: c;
	}
	#test0::after {
	content: counter(c);
	counter-reset: c;
	}
	#test1::after {
	content: counter(c);
	counter-reset: c;
	}
	#test2 {
	counter-reset: c;
	height: 1px;
	width: 1px;
	overflow-x: scroll;
	-webkit-perspective: 1;
	}
	#test3 {
	content: counter(c);
	-webkit-animation-name: a;
	-webkit-animation-duration: 0.01s;
	}
	</style>
	<script>
	if (window.testRunner) {
	testRunner.dumpAsText();
	testRunner.waitUntilDone();
	}

	function finish() {
	document.body.innerHTML = "WebKit Bug 87445 - RenderTableSection::paintCell.<br/>Test passes if it does not crash.";
	if (window.testRunner)
	testRunner.notifyDone();
	}

	onload = function() {
	test0 = document.createElement('div');
	test0.setAttribute('id', 'test0');
	document.body.appendChild(test0);
	test1 = document.createElement('div');
	test1.setAttribute('id', 'test1');
	test0.appendChild(test1);
	test2 = document.createElement('div');
	test2.setAttribute('id', 'test2');
	test1.appendChild(test2);
	test3 = document.createElement('div');
	test3.setAttribute('id', 'test3');
	test2.appendChild(test3);
	test2.style.display = 'table-footer-group';
	document.body.offsetTop;
	setTimeout("finish()", 10);
	}
	</script>
	</head>
	<body>
	</body>
	</html>