blob: 01357691944fa44298457091925785115fe154eb (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
|
<!DOCTYPE html>
<body style="display: inline-grid;">
<style>
.absolutelyPositioned { position: absolute; }
</style>
crbug.com/280451 - Heap-use-after-free in WebCore::LayoutGrid::computePreferredTrackWidth</br>
This test has passed if it didn't crash.
<script>
if (window.testRunner)
testRunner.dumpAsText();
var cell = document.createElement("cell");
cell.setAttribute("class", "absolutelyPositioned");
document.body.appendChild(cell);
window.scrollBy(98, 28);
cell.setAttribute("class", "nonExistent");
</script>
|
