| OLD | NEW | 
|---|
| 1 <html> | 1 <html> | 
| 2 <head> | 2 <head> | 
| 3 <style> | 3 <style> | 
| 4 body { | 4 body { | 
| 5     -webkit-writing-mode: vertical-lr; | 5     -webkit-writing-mode: vertical-lr; | 
| 6 } | 6 } | 
| 7 #test { | 7 #test { | 
| 8     -webkit-text-combine: horizontal; | 8     -webkit-text-combine: horizontal; | 
| 9     height: 7px; | 9     height: 7px; | 
| 10     white-space: pre-wrap; | 10     white-space: pre-wrap; | 
| 11 } | 11 } | 
| 12 </style> | 12 </style> | 
| 13 <script> | 13 <script> | 
| 14 function runTest() { | 14 function runTest() { | 
| 15     if (window.testRunner) | 15     if (window.testRunner) | 
| 16         testRunner.dumpAsText(); | 16         testRunner.dumpAsText(); | 
| 17     document.body.offsetTop; | 17     document.body.offsetTop; | 
| 18     var testContainer = document.getElementById('test'); | 18     var testContainer = document.getElementById('test'); | 
| 19     testContainer.parentNode.removeChild(testContainer); | 19     testContainer.parentNode.removeChild(testContainer); | 
| 20 } | 20 } | 
| 21 </script> | 21 </script> | 
| 22 </head> | 22 </head> | 
| 23 <body onload='runTest()'><p>Test passes if there's no crash.</p> | 23 <body onload='runTest()'><p>Test passes if there's no crash.</p> | 
| 24 <!-- The empty scripts tags are needed to split the RenderCombineText and reprod
    uce the bug. --> | 24 <!-- The empty scripts tags are needed to split the LayoutTextCombine and reprod
    uce the bug. --> | 
| 25 <div id="test"><p>foo   <script></script> | 25 <div id="test"><p>foo   <script></script> | 
| 26   <script></script> | 26   <script></script> | 
| 27 </p> | 27 </p> | 
| 28 </div> | 28 </div> | 
| 29 </body> | 29 </body> | 
| OLD | NEW | 
|---|