LayoutTests/fast/css-generated-content/before-content-with-list-marker-in-anon-block-crash.html

   1 <style>
   2 .c9::before { float: right; content: counter(section); }
   3 .c9 { display: list-item; }
   4 .c19 { display: table-row; }
   5 .c19:nth-child(even) { position: fixed; }
   6 </style>
   7 <script>
   8 var nodes = Array();
   9 function runTest() {
  10     firstDiv = document.createElement('div');
  11     document.documentElement.appendChild(firstDiv);
  12
  13     secondDiv = document.createElement('div');
  14     document.documentElement.appendChild(secondDiv);
  15
  16     childDivListItem = document.createElement('div');
  17     childDivListItem.setAttribute('class', 'c9');
  18     document.documentElement.appendChild(childDivListItem);
  19
  20     citeNode = document.createElement('cite');
  21     citeNode.setAttribute('class', 'c19');
  22     document.documentElement.appendChild(citeNode);
  23
  24     parentDivListItem = document.createElement('div');
  25     parentDivListItem.setAttribute('class', 'c9');
  26
  27     citeNode.appendChild(parentDivListItem);
  28
  29     document.body.offsetTop;
  30     parentDivListItem.appendChild(childDivListItem);
  31     document.body.offsetTop;
  32     secondDiv.setAttribute('class', 'c1');
  33     document.body.offsetTop;
  34     firstDiv.setAttribute('class', 'c1');
  35
  36     if (window.layoutTestController)
  37         layoutTestController.dumpAsText();
  38 }
  39 window.onload = runTest;
  40 </script>
  41 PASS if no assert or crash on debug