| <!DOCTYPE html> |
| <html> |
| Bug 101984: Heap-buffer-overflow in WebCore::LayoutBlockFlow::clone.<br /> |
| Test passes if it does not crash. |
| <body> |
| <table> |
| <div class="container"> |
| <div class="testClass" id="test1"> |
| </div> |
| <div class="testClass"> |
| <div> |
| <i id="test2"></i> |
| </div> |
| </div> |
| </div> |
| </table> |
| <script> |
| if (window.testRunner) |
| testRunner.dumpAsText(); |
| |
| document.head.appendChild(document.createElement("style")); |
| var styleSheet0 = document.styleSheets[0]; |
| var test1 = document.getElementById("test1"); |
| var test2 = document.getElementById("test2"); |
| |
| |
| document.execCommand("SelectAll", true); |
| styleSheet0.insertRule('.testClass { -webkit-column-span: all ; }', 0); |
| test1.appendChild(test2); |
| styleSheet0.insertRule('.testClass::first-letter { border-style: none; }', 0); |
| </script> |
| </body> |
| </html> |
