| <!DOCTYPE html> |
| <html> |
| <head> |
| <style> |
| .c7 { display: table-row-group; } |
| .c7:nth-last-of-type(-n+6) { float: none; } |
| .c21:nth-child(2n) { position: static; float: left; } |
| .c26 { border-style: ridge; content: counter(section);</style> |
| <script> |
| if (window.testRunner) { |
| testRunner.dumpAsText(); |
| testRunner.waitUntilDone(); |
| } |
| |
| function crash() |
| { |
| var img = document.createElement('img'); |
| img.appendChild(select); |
| if (window.testRunner) |
| testRunner.notifyDone(); |
| } |
| |
| function insertNodes() { |
| document.documentElement.appendChild(document.createElement('a')); |
| document.documentElement.appendChild(document.createElement('dfn')); |
| document.documentElement.appendChild(document.createElement('keygen')); |
| var iframe = document.createElement('iframe'); |
| iframe.setAttribute('src', 'dne.html'); |
| document.documentElement.appendChild(iframe); |
| document.documentElement.appendChild(document.createElement('rp')); |
| document.documentElement.appendChild(document.createElement('ul')); |
| document.documentElement.appendChild(document.createElement('option')); |
| document.documentElement.appendChild(document.createElement('label')); |
| document.documentElement.appendChild(document.createElement('table')); |
| document.documentElement.appendChild(document.createElement('mark')); |
| document.documentElement.appendChild(document.createElement('bdo')); |
| document.documentElement.appendChild(document.createElement('colgroup')); |
| document.documentElement.appendChild(document.createElement('strong')); |
| |
| select = document.createElement('select'); |
| document.documentElement.appendChild(select); |
| |
| var sup = document.createElement('sup'); |
| sup.setAttribute('class', 'c7'); |
| document.documentElement.appendChild(sup); |
| var td = document.createElement('td'); |
| td.setAttribute('class', 'c21'); |
| document.documentElement.appendChild(td); |
| |
| var th = document.createElement('th'); |
| th.setAttribute('colspan', '2'); |
| th.setAttribute('class', 'c26'); |
| sup.appendChild(th); |
| |
| setTimeout(crash, 0); |
| } |
| window.addEventListener("load", insertNodes, false); |
| </script> |
| </head> |
| <body> |
| <p> Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=70171">70171</a>: Crash in RenderTableSection::splitColumn</p> |
| <p> This test PASSES if it does not CRASH or ASSERT.</p> |
| </body> |
| </html> |
