OLD | NEW |
1 <!DOCTYPE html> | 1 <!DOCTYPE html> |
2 <body style="display: inline-grid;"> | 2 <body style="display: inline-grid;"> |
3 <style> | 3 <style> |
4 .absolutelyPositioned { position: absolute; } | 4 .absolutelyPositioned { position: absolute; } |
5 </style> | 5 </style> |
6 crbug.com/280451 - Heap-use-after-free in WebCore::RenderGrid::computePreferredT
rackWidth</br> | 6 crbug.com/280451 - Heap-use-after-free in WebCore::LayoutGrid::computePreferredT
rackWidth</br> |
7 This test has passed if it didn't crash. | 7 This test has passed if it didn't crash. |
8 <script> | 8 <script> |
9 if (window.testRunner) | 9 if (window.testRunner) |
10 testRunner.dumpAsText(); | 10 testRunner.dumpAsText(); |
11 | 11 |
12 var cell = document.createElement("cell"); | 12 var cell = document.createElement("cell"); |
13 cell.setAttribute("class", "absolutelyPositioned"); | 13 cell.setAttribute("class", "absolutelyPositioned"); |
14 document.body.appendChild(cell); | 14 document.body.appendChild(cell); |
15 window.scrollBy(98, 28); | 15 window.scrollBy(98, 28); |
16 cell.setAttribute("class", "nonExistent"); | 16 cell.setAttribute("class", "nonExistent"); |
17 </script> | 17 </script> |
OLD | NEW |