| <!DOCTYPE html> | |
| <style> | |
| ruby:after { | |
| display: block; | |
| content: ""; | |
| } | |
| </style> | |
| <p> | |
| Bug 106384: Heap-use-after-free in WebCore::LayoutObject::willBeRemovedFromTree. | |
| </p> | |
| <script> | |
| if (window.testRunner) | |
| testRunner.dumpAsText(); | |
| onload = function() { | |
| var ruby = document.createElement('ruby'); | |
| document.body.appendChild(ruby); | |
| // Cause a layout. | |
| document.body.offsetLeft; | |
| ruby.appendChild(document.createTextNode('Passed if this test did not crash or assert.')); | |
| }; | |
| </script> |