blob: d81c39a15116a687f8e53bf1a9e705e17fa75e64 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
|
<!DOCTYPE html>
<style>
.c15:nth-last-of-type(-n+6) { display: table; }
</style>
<script>
if (window.testRunner)
testRunner.dumpAsText();
function crash() {
span = document.createElement('span');
document.documentElement.appendChild(span);
quote = document.createElement('q');
quote.setAttribute('class', 'c15');
document.documentElement.appendChild(quote);
caption = document.createElement('caption');
quote.appendChild(caption);
span.offsetTop;
span.appendChild(caption);
span.offsetTop;
span.innerHTML = "<a href='https://bugs.webkit.org/show_bug.cgi?id=95090'>Bug 95090</a>: Crash in LayoutTable::removeCaption<br/>This test PASSED as it did not crash.";
}
window.onload = crash;
</script>
|
