<!DOCTYPE html> <style> .c15:nth-last-of-type(-n+6) { display: table; } </style> <script> if (window.testRunner) testRunner.dumpAsText(); function crash() { span = document.createElement('span'); document.documentElement.appendChild(span); quote = document.createElement('q'); quote.setAttribute('class', 'c15'); document.documentElement.appendChild(quote); caption = document.createElement('caption'); quote.appendChild(caption); span.offsetTop; span.appendChild(caption); span.offsetTop; span.innerHTML = "<a href='https://bugs.webkit.org/show_bug.cgi?id=95090'>Bug 95090</a>: Crash in LayoutTable::removeCaption<br/>This test PASSED as it did not crash."; } window.onload = crash; </script>