| <!DOCTYPE html> |
| <html> |
| <head> |
| <style> |
| .lastTableHeaderGroup:last-of-type { display: table-header-group; }</style> |
| </style> |
| <script> |
| if (window.testRunner) { |
| testRunner.dumpAsText(); |
| testRunner.waitUntilDone(); |
| } |
| |
| function crash() |
| { |
| rubyTag.appendChild(lastTableHead); |
| if (window.testRunner) |
| testRunner.notifyDone(); |
| } |
| |
| function insertNodes() { |
| var tableHead = document.createElement('th'); |
| tableHead.setAttribute('colspan', '5'); |
| tableHead.setAttribute('class', 'lastTableHeaderGroup'); |
| document.documentElement.appendChild(tableHead); |
| tableHead.appendChild(document.createElement('p')); |
| lastTableHead = document.createElement('th'); |
| document.documentElement.appendChild(lastTableHead); |
| rubyTag = document.createElement('rt'); |
| setTimeout(crash, 0); |
| } |
| window.addEventListener("load", insertNodes, false); |
| </script> |
| </head> |
| <body> |
| <p> Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=70171">70171</a>: Crash in RenderTableSection::splitColumn</p> |
| <p> This test PASSES if it does not CRASH or ASSERT.</p> |
| </body> |
| </html> |
