| OLD | NEW |
| 1 <!DOCTYPE html> | 1 <!DOCTYPE html> |
| 2 <body style="display: inline-grid;"> | 2 <body style="display: inline-grid;"> |
| 3 <style> | 3 <style> |
| 4 .absolutelyPositioned { position: absolute; } | 4 .absolutelyPositioned { position: absolute; } |
| 5 </style> | 5 </style> |
| 6 crbug.com/280451 - Heap-use-after-free in WebCore::RenderGrid::computePreferredT
rackWidth</br> | 6 crbug.com/280451 - Heap-use-after-free in WebCore::LayoutGrid::computePreferredT
rackWidth</br> |
| 7 This test has passed if it didn't crash. | 7 This test has passed if it didn't crash. |
| 8 <script> | 8 <script> |
| 9 if (window.testRunner) | 9 if (window.testRunner) |
| 10 testRunner.dumpAsText(); | 10 testRunner.dumpAsText(); |
| 11 | 11 |
| 12 var cell = document.createElement("cell"); | 12 var cell = document.createElement("cell"); |
| 13 cell.setAttribute("class", "absolutelyPositioned"); | 13 cell.setAttribute("class", "absolutelyPositioned"); |
| 14 document.body.appendChild(cell); | 14 document.body.appendChild(cell); |
| 15 window.scrollBy(98, 28); | 15 window.scrollBy(98, 28); |
| 16 cell.setAttribute("class", "nonExistent"); | 16 cell.setAttribute("class", "nonExistent"); |
| 17 </script> | 17 </script> |
| OLD | NEW |