OLD | NEW |
1 <!DOCTYPE html> | 1 <!DOCTYPE html> |
2 <html> | 2 <html> |
3 Bug 101970: Heap-use-after-free in WebCore::RenderLayerModelObject::hasSelfPaint
ingLayer<br /> | 3 Bug 101970: Heap-use-after-free in WebCore::RenderLayerModelObject::hasSelfPaint
ingLayer<br /> |
4 Test passes if it does not crash.<br /> | 4 Test passes if it does not crash.<br /> |
5 <div id="container"> | 5 <div id="container"> |
6 <q> | 6 <q> |
7 <q id="test1"></q> | 7 <q id="test1"></q> |
8 </q> | 8 </q> |
9 <q id="test2"> | 9 <q id="test2"> |
10 <q style="float: left"></q> | 10 <q style="float: left"></q> |
11 <q id="test3"> | 11 <q id="test3"> |
12 <q style="position: fixed;"> | 12 <q style="position: fixed;"> |
13 </q> | 13 </q> |
14 </q> | 14 </q> |
15 </div> | 15 </div> |
16 <script> | 16 <script> |
17 if (window.testRunner) | 17 if (window.testRunner) |
18 testRunner.dumpAsText(); | 18 testRunner.dumpAsText(); |
19 | 19 |
20 document.body.offsetTop; | 20 document.body.offsetTop; |
21 test3.style.display = "table-footer-group"; | 21 test3.style.display = "table-footer-group"; |
22 test3.focus(); | 22 test3.focus(); |
23 test1.style.display = "table-row-group"; | 23 test1.style.display = "table-row-group"; |
24 test2.style.display = "inline-block"; | 24 test2.style.display = "inline-block"; |
25 </script> | 25 </script> |
26 </html> | 26 </html> |
OLD | NEW |