| <!DOCTYPE html> |
| <style> |
| .c15:nth-last-of-type(-n+6) { display: table; } |
| </style> |
| <script> |
| if (window.testRunner) |
| testRunner.dumpAsText(); |
| |
| function crash() { |
| span = document.createElement('span'); |
| document.documentElement.appendChild(span); |
| quote = document.createElement('q'); |
| quote.setAttribute('class', 'c15'); |
| document.documentElement.appendChild(quote); |
| caption = document.createElement('caption'); |
| quote.appendChild(caption); |
| span.offsetTop; |
| span.appendChild(caption); |
| span.offsetTop; |
| span.innerHTML = "<a href='https://bugs.webkit.org/show_bug.cgi?id=95090'>Bug 95090</a>: Crash in LayoutTable::removeCaption<br/>This test PASSED as it did not crash."; |
| } |
| window.onload = crash; |
| </script> |
