| Index: third_party/WebKit/LayoutTests/fast/writing-mode/orthogonal-writing-modes-floats-crash-3.html
|
| diff --git a/third_party/WebKit/LayoutTests/fast/writing-mode/orthogonal-writing-modes-floats-crash-3.html b/third_party/WebKit/LayoutTests/fast/writing-mode/orthogonal-writing-modes-floats-crash-3.html
|
| new file mode 100644
|
| index 0000000000000000000000000000000000000000..5cc35ba32e2d47748ab11128c99b1d3618f24b79
|
| --- /dev/null
|
| +++ b/third_party/WebKit/LayoutTests/fast/writing-mode/orthogonal-writing-modes-floats-crash-3.html
|
| @@ -0,0 +1,41 @@
|
| +<!DOCTYPE html>
|
| +
|
| +<!-- Disable auto scrollbars, to avoid an extra layout pass, which
|
| + would hide the bug. The original fuzzer test instead used an
|
| + insane margin on an atomic inline to make sure the scrollbars
|
| + stayed put. -->
|
| +<style>body { overflow:scroll; }</style>
|
| +
|
| +<p>PASS if no crash.</p>
|
| +
|
| +<div id="rightFloat" style="float:right; height:40px;"></div>
|
| +<div style="float:left; height:300px;"></div>
|
| +<span>
|
| + <div id="inlineBlock2" style="display:none; width:30px; height:300px;"></div>
|
| + <span id="inline" style="display:none;">x</span>
|
| +</span>
|
| +<div>
|
| + <div style="height:40px;"></div>
|
| + <div style="display:table; writing-mode:vertical-lr;">
|
| + <div>
|
| + <div id="dummyBlock" style="display:none;"></div>
|
| + </div>
|
| + <div id="inlineBlock1" style="display:inline-block; width:30px; height:300px;"></div>
|
| + </div>
|
| +</div>
|
| +<script src="../../resources/testharness.js"></script>
|
| +<script src="../../resources/testharnessreport.js"></script>
|
| +<script>
|
| +if (window.testRunner)
|
| + testRunner.dumpAsText();
|
| +test(() => {
|
| + document.body.offsetTop;
|
| + document.getElementById("inlineBlock1").style.display = "none";
|
| + document.getElementById("inlineBlock2").style.display = "inline-block";
|
| + document.body.offsetTop;
|
| + document.getElementById("rightFloat").style.display = "none";
|
| + document.getElementById("dummyBlock").style.display = "block";
|
| + document.body.offsetTop;
|
| + document.getElementById("inline").style.display = "inline";
|
| +}, "no crash or assertion failure");
|
| +</script>
|
|
|
Chromium Code Reviews
Issue 2737253003:
Remove floating objects from descendants of subtree roots (Closed)
