<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <script> function test() { if (window.testRunner) testRunner.dumpAsText(); document.getElementById("result").firstChild.data = 'SUCCESS!'; var ruby = document.getElementById('R'); var block = document.getElementById('D'); var newRT = document.createElement('rt'); var newRTText = document.createTextNode('new ruby text'); newRT.appendChild(newRTText); ruby.insertBefore(newRT, block); } </script> </head> <!-- Inserting a <rt> element, causing a split of block flow to inline flow and block flow --> <!-- As this is a malformed example we don't care about the exact rendering output, only that it doesn't crash --> <body onload="test()"> <div id="result">FAILED!</p> <br> <br> <ruby id="R">text <div id="D">block</div> more text<rt>ruby text</rt></ruby> </body> </html>