| <!DOCTYPE html> |
| <html> |
| <head> |
| <style> |
| :after { display: table-cell; content: "Foo"; } |
| :first-child { display: table-cell; } |
| :before { display: table-column; content: "Bar"; } |
| </style> |
| <script type="text/javascript"> |
| if (window.testRunner) |
| testRunner.dumpAsText(); |
| |
| function crash(event) { |
| newContent = document.createTextNode("Lorem Ipsum"); |
| var divElement = document.createElement("div"); |
| divElement.appendChild(newContent); |
| divElement.appendChild(document.createElement("div")); |
| document.getElementById("target").appendChild(divElement); |
| |
| // For some reason, DRT dumps the <style> so remove it here to clean the dump. |
| var style = document.getElementsByTagName("style")[0]; |
| style.parentNode.removeChild(style); |
| } |
| |
| window.addEventListener("load", crash, false) |
| </script> |
| </head> |
| <body id="target"> |
| <p>Test for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=89496">89496</a>: Crash in LayoutTableSection::addCell.</p> |
| <p>This test passes if it doesn't CRASH or ASSERT.</p> |
| </body> |
| </html> |
