| <!doctype html> | |
| <title>BODY list-item crash inserting extra BODY</title> | |
| <link rel="help" href="https://crbug.com/1298917"> | |
| <style> | |
| body { | |
| display: list-item; | |
| } | |
| div { | |
| /* Multicol and table display to trigger legacy layout */ | |
| display: table-row-group; | |
| column-count: 1; | |
| } | |
| </style> | |
| <body> | |
| <p>Pass if no crash.</p> | |
| <div></div> | |
| </body> | |
| <script> | |
| document.documentElement.offsetTop; | |
| document.documentElement.insertBefore(document.createElement("body"), document.body); | |
| </script> |