| OLD | NEW |
| (Empty) |
| 1 <!DOCTYPE html> | |
| 2 <html> | |
| 3 Bug 101984: Heap-buffer-overflow in WebCore::RenderBlock::clone.<br /> | |
| 4 Test passes if it does not crash. | |
| 5 <body> | |
| 6 <table> | |
| 7 <div class="container"> | |
| 8 <div class="testClass" id="test1"> | |
| 9 </div> | |
| 10 <div class="testClass"> | |
| 11 <div> | |
| 12 <i id="test2"></i> | |
| 13 </div> | |
| 14 </div> | |
| 15 </div> | |
| 16 </table> | |
| 17 <script> | |
| 18 if (window.testRunner) | |
| 19 testRunner.dumpAsText(); | |
| 20 | |
| 21 document.head.appendChild(document.createElement("style")); | |
| 22 var styleSheet0 = document.styleSheets[0]; | |
| 23 var test1 = document.getElementById("test1"); | |
| 24 var test2 = document.getElementById("test2"); | |
| 25 | |
| 26 | |
| 27 document.execCommand("SelectAll", true); | |
| 28 styleSheet0.insertRule('.testClass { -webkit-column-span: all ; }', 0); | |
| 29 test1.appendChild(test2); | |
| 30 styleSheet0.insertRule('.testClass::first-letter { border-style: none; }', 0); | |
| 31 </script> | |
| 32 </body> | |
| 33 </html> | |
| OLD | NEW |