blob: a1cb3dd593e5cb76de877276a972c7069b1c02c6 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
|
<!DOCTYPE html>
<body style="display: inline-grid;">
<style>
.absolutelyPositioned { position: absolute; }
</style>
crbug.com/280451 - Heap-use-after-free in WebCore::RenderGrid::computePreferredTrackWidth</br>
This test has passed if it didn't crash.
<script>
if (window.testRunner)
testRunner.dumpAsText();
var cell = document.createElement("cell");
cell.setAttribute("class", "absolutelyPositioned");
document.body.appendChild(cell);
window.scrollBy(98, 28);
cell.setAttribute("class", "nonExistent");
</script>
|
