| OLD | NEW |
| 1 <!DOCTYPE html> | 1 <!DOCTYPE html> |
| 2 <style> | 2 <style> |
| 3 .class1 { -webkit-column-span: all; } | 3 .class1 { -webkit-column-span: all; } |
| 4 .class2 > .class3 { float: right; content: open-quote; } | 4 .class2 > .class3 { float: right; content: open-quote; } |
| 5 .class3:last-of-type { -webkit-column-width: 1px; } | 5 .class3:last-of-type { -webkit-column-width: 1px; } |
| 6 .class3:nth-last-child(2n+10000000000000000) { -webkit-column-span: all;</st
yle> | 6 .class3:nth-last-child(2n+10000000000000000) { -webkit-column-span: all;</st
yle> |
| 7 <script> | 7 <script> |
| 8 if (window.testRunner) | 8 if (window.testRunner) |
| 9 testRunner.dumpAsText(); | 9 testRunner.dumpAsText(); |
| 10 | 10 |
| (...skipping 17 matching lines...) Expand all Loading... |
| 28 test4.appendChild(test5); | 28 test4.appendChild(test5); |
| 29 document.documentElement.offsetTop; | 29 document.documentElement.offsetTop; |
| 30 test5.setAttribute('class', 'class3'); | 30 test5.setAttribute('class', 'class3'); |
| 31 document.documentElement.offsetTop; | 31 document.documentElement.offsetTop; |
| 32 test2.appendChild(test6); | 32 test2.appendChild(test6); |
| 33 } | 33 } |
| 34 window.onload = crash; | 34 window.onload = crash; |
| 35 </script> | 35 </script> |
| 36 <p><a href="https://bugs.webkit.org/show_bug.cgi?id=107189">Bug 107189</a>: Regr
ession(r131539): Heap-use-after-free in WebCore::RenderBlock::willBeDestroyed</p
> | 36 <p><a href="https://bugs.webkit.org/show_bug.cgi?id=107189">Bug 107189</a>: Regr
ession(r131539): Heap-use-after-free in WebCore::RenderBlock::willBeDestroyed</p
> |
| 37 <p>This test has PASSED if it didn't CRASH.</p> | 37 <p>This test has PASSED if it didn't CRASH.</p> |
| OLD | NEW |