| <!DOCTYPE html> | |
| <body style="display: inline-grid;"> | |
| <style> | |
| .absolutelyPositioned { position: absolute; } | |
| </style> | |
| crbug.com/280451 - Heap-use-after-free in WebCore::LayoutGrid::computePreferredTrackWidth</br> | |
| This test has passed if it didn't crash. | |
| <script> | |
| if (window.testRunner) | |
| testRunner.dumpAsText(); | |
| var cell = document.createElement("cell"); | |
| cell.setAttribute("class", "absolutelyPositioned"); | |
| document.body.appendChild(cell); | |
| window.scrollBy(98, 28); | |
| cell.setAttribute("class", "nonExistent"); | |
| </script> |