Index: LayoutTests/fast/multicol/span/table-row-group-crash.html |
diff --git a/LayoutTests/fast/multicol/span/table-row-group-crash.html b/LayoutTests/fast/multicol/span/table-row-group-crash.html |
new file mode 100644 |
index 0000000000000000000000000000000000000000..9daac2b910a3e3dd0228835a5590f96e03dbdb02 |
--- /dev/null |
+++ b/LayoutTests/fast/multicol/span/table-row-group-crash.html |
@@ -0,0 +1,29 @@ |
+<!DOCTYPE html> |
+<script> |
+ if (window.testRunner) |
+ testRunner.dumpAsText(); |
+</script> |
+<style> |
+#invalid-spanner { display:none; -webkit-column-span:all; } |
+</style> |
+ |
+Test passes if it does not CRASH. |
+<div style="-webkit-column-count:1;"> |
+ <div> |
+ <span id="inline" style="display:none;"></span> |
+ <div id="invalid-spanner"></div> |
+ </div> |
+</div> |
+ |
+<script> |
+ document.body.offsetTop; |
+ document.getElementById("inline").style.display = "inline"; |
+ |
+ // Note that a table-row-group isn't allowed to become a spanner. |
+ document.getElementById("invalid-spanner").style.display = "table-row-group"; |
+ |
+ onload = function() { |
+ document.body.offsetTop; |
+ document.getElementById("invalid-spanner").style.webkitColumnSpan = "none"; |
+ } |
+</script> |