blob: 0f4237fb30a6aa5f2513f9c004017dee68f24328 [file] [log] [blame]
<!DOCTYPE html>
<html>
Bug 101970: Heap-use-after-free in WebCore::RenderLayerModelObject::hasSelfPaintingLayer<br />
Test passes if it does not crash.<br />
<div id="container">
<q>
<q id="test1"></q>
</q>
<q id="test2">
<q style="float: left"></q>
<q id="test3">
<q style="position: fixed;">
</q>
</q>
</div>
<script>
if (window.testRunner)
testRunner.dumpAsText();
document.body.offsetTop;
test3.style.display = "table-footer-group";
test3.focus();
test1.style.display = "table-row-group";
test2.style.display = "inline-block";
</script>
</html>