third_party/WebKit/LayoutTests/fast/dynamic/insert-before-table-part-in-continuation.html

<p>
    Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=15362">http://bugs.webkit.org/show_bug.cgi?id=15362</a>
    Safari Crashes when opening a JS TreeGrid widget</i>.
</p>
<p>
    The test sets up an inline parent with a child that is some kind of table part. The child gets broken off into a continuation and anonymous table parts get created below and/or above the table parts. Then the test tries to insert a new child into the inline, specifying the table part as the "before child". The resulting render tree should look just like it would look if the parent was a block.
</p>
<script>
    function test(display, element)
    {
        // Setup

        var inline = document.createElement("span");
        inline.appendChild(document.createTextNode("Text..."));
        var beforeChild = inline.appendChild(document.createElement("div"));
        beforeChild.style.display = display;
        beforeChild.appendChild(document.createTextNode("...continues here"));
        document.body.appendChild(document.createElement("div")).appendChild(inline);

        // Test
        var newChild = element ? document.createElement(element) : document.createTextNode("goes here and");
        inline.insertBefore(newChild, beforeChild);
    }

    test("table-cell");
    test("table-cell", "td");
    test("table-cell", "tr");
    test("table-cell", "span");
    test("table-cell", "div");

    test("table-row");
    test("table-row", "td");
    test("table-row", "tr");
    test("table-row", "span");
    test("table-row", "div");

    test("table-row-group");
    test("table-row-group", "td");
    test("table-row-group", "tr");
    test("table-row-group", "span");
    test("table-row-group", "div");
</script>