<!DOCTYPE html> | |
<body style="display: inline-grid;"> | |
<style> | |
.absolutelyPositioned { position: absolute; } | |
</style> | |
crbug.com/280451 - Heap-use-after-free in WebCore::LayoutGrid::computePreferredTrackWidth</br> | |
This test has passed if it didn't crash. | |
<script> | |
if (window.testRunner) | |
testRunner.dumpAsText(); | |
var cell = document.createElement("cell"); | |
cell.setAttribute("class", "absolutelyPositioned"); | |
document.body.appendChild(cell); | |
window.scrollBy(98, 28); | |
cell.setAttribute("class", "nonExistent"); | |
</script> |