OLD | NEW |
| (Empty) |
1 <!DOCTYPE html> | |
2 <html> | |
3 Bug 101984: Heap-buffer-overflow in WebCore::RenderBlock::clone.<br /> | |
4 Test passes if it does not crash. | |
5 <body> | |
6 <table> | |
7 <div class="container"> | |
8 <div class="testClass" id="test1"> | |
9 </div> | |
10 <div class="testClass"> | |
11 <div> | |
12 <i id="test2"></i> | |
13 </div> | |
14 </div> | |
15 </div> | |
16 </table> | |
17 <script> | |
18 if (window.testRunner) | |
19 testRunner.dumpAsText(); | |
20 | |
21 document.head.appendChild(document.createElement("style")); | |
22 var styleSheet0 = document.styleSheets[0]; | |
23 var test1 = document.getElementById("test1"); | |
24 var test2 = document.getElementById("test2"); | |
25 | |
26 | |
27 document.execCommand("SelectAll", true); | |
28 styleSheet0.insertRule('.testClass { -webkit-column-span: all ; }', 0); | |
29 test1.appendChild(test2); | |
30 styleSheet0.insertRule('.testClass::first-letter { border-style: none; }', 0); | |
31 </script> | |
32 </body> | |
33 </html> | |
OLD | NEW |