| OLD | NEW |
| 1 <!DOCTYPE html> | 1 <!DOCTYPE html> |
| 2 | |
| 3 <style> | 2 <style> |
| 4 ruby:after { | 3 ruby::after { |
| 5 display: block; | 4 display: block; |
| 6 content: ""; | 5 content: ""; |
| 7 } | 6 } |
| 7 ruby { |
| 8 display: block; |
| 9 } |
| 8 </style> | 10 </style> |
| 9 | 11 |
| 10 <p> | |
| 11 Bug 106384: Heap-use-after-free in WebCore::LayoutObject::willBeRemovedFromT
ree. | |
| 12 </p> | |
| 13 | |
| 14 <script> | 12 <script> |
| 15 if (window.testRunner) | 13 if (window.testRunner) |
| 16 testRunner.dumpAsText(); | 14 testRunner.dumpAsText(); |
| 17 | 15 |
| 18 onload = function() { | 16 onload = function() { |
| 19 var ruby = document.createElement('ruby'); | 17 var ruby = document.createElement('ruby'); |
| 20 document.body.appendChild(ruby); | 18 document.body.appendChild(ruby); |
| 21 // Cause a layout. | 19 document.body.offsetTop; |
| 22 document.body.offsetLeft; | |
| 23 ruby.appendChild(document.createTextNode('Passed if this test did not crash
or assert.')); | 20 ruby.appendChild(document.createTextNode('Passed if this test did not crash
or assert.')); |
| 24 }; | 21 } |
| 25 </script> | 22 </script> |
| OLD | NEW |