<p> Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=15362">http://bugs.webkit.org/show_bug.cgi?id=15362</a> Safari Crashes when opening a JS TreeGrid widget</i>. </p> <p> The test sets up an inline parent with a child that is some kind of table part. The child gets broken off into a continuation and anonymous table parts get created below and/or above the table parts. Then the test tries to insert a new child into the inline, specifying the table part as the "before child". The resulting render tree should look just like it would look if the parent was a block. </p> <script> function test(display, element) { // Setup var inline = document.createElement("span"); inline.appendChild(document.createTextNode("Text...")); var beforeChild = inline.appendChild(document.createElement("div")); beforeChild.style.display = display; beforeChild.appendChild(document.createTextNode("...continues here")); document.body.appendChild(document.createElement("div")).appendChild(inline); // Test var newChild = element ? document.createElement(element) : document.createTextNode("goes here and"); inline.insertBefore(newChild, beforeChild); } test("table-cell"); test("table-cell", "td"); test("table-cell", "tr"); test("table-cell", "span"); test("table-cell", "div"); test("table-row"); test("table-row", "td"); test("table-row", "tr"); test("table-row", "span"); test("table-row", "div"); test("table-row-group"); test("table-row-group", "td"); test("table-row-group", "tr"); test("table-row-group", "span"); test("table-row-group", "div"); </script>