| <!DOCTYPE html> | |
| <html> | |
| <head> | |
| <script> | |
| if (window.testRunner) | |
| testRunner.dumpAsText(); | |
| function crash() { | |
| var firstBody = document.getElementById("firstBody"); | |
| firstBody.removeChild(firstBody.firstChild); | |
| firstBody.offsetTop; | |
| } | |
| window.addEventListener("load", crash, false); | |
| </script> | |
| </head> | |
| <body> | |
| <p>Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=71246">71246</a>: REGRESSION(98738): Multiple crashes in the table rendering code</p> | |
| <p>This test PASSES if it does not CRASH.</p> | |
| <table style="table-layout:fixed; width:0;"> | |
| <tbody id="firstBody"><tr></tr></tbody> | |
| </table> | |
| </body> | |
| </html> |