Index: LayoutTests/fast/table/table-rowspan-crash-with-huge-rowspan-cells-2.html |
diff --git a/LayoutTests/fast/table/table-rowspan-crash-with-huge-rowspan-cells-2.html b/LayoutTests/fast/table/table-rowspan-crash-with-huge-rowspan-cells-2.html |
new file mode 100644 |
index 0000000000000000000000000000000000000000..7edf125eea349ebb4f06e6e8d516470fba213a70 |
--- /dev/null |
+++ b/LayoutTests/fast/table/table-rowspan-crash-with-huge-rowspan-cells-2.html |
@@ -0,0 +1,17 @@ |
+<!DOCTYPE html> |
+<html> |
+<script type="text/javascript"> if (window.testRunner) testRunner.dumpAsText(); </script> |
Julien - ping for review
2013/09/24 21:18:09
Let's indent that like our code and remove the unn
a.suchit
2013/09/25 06:12:48
Done.
|
+<body> |
+<h3>Test for chromium bug : <a href="https://code.google.com/p/chromium/issues/detail?id=296003">296003</a>. Heap-buffer-overflow in void std::__final_insertion_sort.</h3> |
+<h4>It should not crash.</h4> |
Julien - ping for review
2013/09/24 21:18:09
For this test to PASS, it should not crash. (witho
a.suchit
2013/09/25 06:12:48
Done.
|
+<table> |
+<td rowspan=3>><td rowspan=3>><td rowspan=6>><td rowspan=4</td> |
Julien - ping for review
2013/09/24 21:18:09
Could we change the content '>' into a more explic
a.suchit
2013/09/25 06:12:48
Done.
|
+ <td rowspan=16><td rowspan=4><td rowspan=12><td rowspan=4><td rowspan=12><tr>><tr> |
+ <td rowspan=3><td rowspan=8><td rowspan=8><td rowspan=8><td rowspan=8></tr> |
+<td><tr> |
+ <td rowspan=4><td rowspan=370><tr><tr>><tr><td rowspan=6><td rowspan=6>>></tr> |
+ <td rowspan=4><td rowspan=12><td rowspan=16><td rowspan=179><td rowspan=33</tr> |
+<tr> |
+<td rowspan=35><td rowspan=3><td rowspan=6><td rowspan=24><td rowspan=19><td rowspan=3><td rowspan=13><td rowspan=22>><td rowspan=5><td rowspan=20> |
+</body> |
+</html> |