OLD | NEW |
1 <!DOCTYPE html> | 1 <!DOCTYPE html> |
2 | |
3 <style> | 2 <style> |
4 ruby:after { | 3 ruby::after { |
5 display: block; | 4 display: block; |
6 content: ""; | 5 content: ""; |
7 } | 6 } |
| 7 ruby { |
| 8 display: block; |
| 9 } |
8 </style> | 10 </style> |
9 | 11 |
10 <p> | |
11 Bug 106384: Heap-use-after-free in WebCore::LayoutObject::willBeRemovedFromT
ree. | |
12 </p> | |
13 | |
14 <script> | 12 <script> |
15 if (window.testRunner) | 13 if (window.testRunner) |
16 testRunner.dumpAsText(); | 14 testRunner.dumpAsText(); |
17 | 15 |
18 onload = function() { | 16 onload = function() { |
19 var ruby = document.createElement('ruby'); | 17 var ruby = document.createElement('ruby'); |
20 document.body.appendChild(ruby); | 18 document.body.appendChild(ruby); |
21 // Cause a layout. | 19 document.body.offsetTop; |
22 document.body.offsetLeft; | |
23 ruby.appendChild(document.createTextNode('Passed if this test did not crash
or assert.')); | 20 ruby.appendChild(document.createTextNode('Passed if this test did not crash
or assert.')); |
24 }; | 21 } |
25 </script> | 22 </script> |
OLD | NEW |