blob: 9720e71e150da816e24b5dbb376598584702c7ca [file] [log] [blame]
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
Test passes if it does not crash.
<head id="head1" style="-webkit-writing-mode: horizontal-bt;"></head>
<i id="i1"><button id="button1"></button></i>
<td id="td1"><body id="body2"></body></td>
<i id="i2"></i>
<style>
.class1 { float: left; }
</style>
<script>
if (window.testRunner)
testRunner.dumpAsText();
var docElement = document.documentElement;
function crash() {
head1 = document.getElementById("head1");
i1 = document.getElementById("i1");
td1 = document.getElementById("td1");
i2 = document.getElementById("i2");
body2 = document.getElementById("body2");
button1 = document.getElementById("button1");
// Makes it float and then intrude into anonymous block parent of i2.
button1.classList.toggle("class1");
// Moving td1, moves its body child. Body child inherits writing mode(bt) from head.
// And updating body's writing mode updates docElement's writing mode.
head1.appendChild(td1);
docElement.offsetTop;
head1.style.display = "list-item";
docElement.offsetTop;
button1.classList.toggle("class1");
}
document.addEventListener("DOMContentLoaded", crash, false);
</script>
</html>