OLD | NEW |
1 <!DOCTYPE html> | 1 <!DOCTYPE html> |
2 <style> | 2 <style> |
3 .class1 { -webkit-column-span: all; } | 3 .class1 { -webkit-column-span: all; } |
4 .class2 > .class3 { float: right; content: open-quote; } | 4 .class2 > .class3 { float: right; content: open-quote; } |
5 .class3:last-of-type { -webkit-column-width: 1px; } | 5 .class3:last-of-type { -webkit-column-width: 1px; } |
6 .class3:nth-last-child(2n+10000000000000000) { -webkit-column-span: all;</st
yle> | 6 .class3:nth-last-child(2n+10000000000000000) { -webkit-column-span: all;</st
yle> |
7 <script> | 7 <script> |
8 if (window.testRunner) | 8 if (window.testRunner) |
9 testRunner.dumpAsText(); | 9 testRunner.dumpAsText(); |
10 | 10 |
(...skipping 17 matching lines...) Expand all Loading... |
28 test4.appendChild(test5); | 28 test4.appendChild(test5); |
29 document.documentElement.offsetTop; | 29 document.documentElement.offsetTop; |
30 test5.setAttribute('class', 'class3'); | 30 test5.setAttribute('class', 'class3'); |
31 document.documentElement.offsetTop; | 31 document.documentElement.offsetTop; |
32 test2.appendChild(test6); | 32 test2.appendChild(test6); |
33 } | 33 } |
34 window.onload = crash; | 34 window.onload = crash; |
35 </script> | 35 </script> |
36 <p><a href="https://bugs.webkit.org/show_bug.cgi?id=107189">Bug 107189</a>: Regr
ession(r131539): Heap-use-after-free in WebCore::RenderBlock::willBeDestroyed</p
> | 36 <p><a href="https://bugs.webkit.org/show_bug.cgi?id=107189">Bug 107189</a>: Regr
ession(r131539): Heap-use-after-free in WebCore::RenderBlock::willBeDestroyed</p
> |
37 <p>This test has PASSED if it didn't CRASH.</p> | 37 <p>This test has PASSED if it didn't CRASH.</p> |
OLD | NEW |