| OLD | NEW |
| 1 <!DOCTYPE html> | 1 <!DOCTYPE html> |
| 2 <html> | 2 <html> |
| 3 Bug 101970: Heap-use-after-free in WebCore::RenderLayerModelObject::hasSelfPaint
ingLayer<br /> | 3 Bug 101970: Heap-use-after-free in WebCore::RenderLayerModelObject::hasSelfPaint
ingLayer<br /> |
| 4 Test passes if it does not crash.<br /> | 4 Test passes if it does not crash.<br /> |
| 5 <div id="container"> | 5 <div id="container"> |
| 6 <q> | 6 <q> |
| 7 <q id="test1"></q> | 7 <q id="test1"></q> |
| 8 </q> | 8 </q> |
| 9 <q id="test2"> | 9 <q id="test2"> |
| 10 <q style="float: left"></q> | 10 <q style="float: left"></q> |
| 11 <q id="test3"> | 11 <q id="test3"> |
| 12 <q style="position: fixed;"> | 12 <q style="position: fixed;"> |
| 13 </q> | 13 </q> |
| 14 </q> | 14 </q> |
| 15 </div> | 15 </div> |
| 16 <script> | 16 <script> |
| 17 if (window.testRunner) | 17 if (window.testRunner) |
| 18 testRunner.dumpAsText(); | 18 testRunner.dumpAsText(); |
| 19 | 19 |
| 20 document.body.offsetTop; | 20 document.body.offsetTop; |
| 21 test3.style.display = "table-footer-group"; | 21 test3.style.display = "table-footer-group"; |
| 22 test3.focus(); | 22 test3.focus(); |
| 23 test1.style.display = "table-row-group"; | 23 test1.style.display = "table-row-group"; |
| 24 test2.style.display = "inline-block"; | 24 test2.style.display = "inline-block"; |
| 25 </script> | 25 </script> |
| 26 </html> | 26 </html> |
| OLD | NEW |