src/third_party/WebKit/LayoutTests/fast/regions/region-range-for-box-crash.html

   1 <!doctype html>
   2 <html>
   3     <head>
   4         <style>
   5             #el0 {
   6                 -webkit-flow-from: a;
   7                 content: counter(c);
   8             }
   9             #el2 {
  10                 -webkit-flow-into: a;
  11             }
  12         </style>
  13         <script>
  14             if (window.testRunner)
  15                 testRunner.dumpAsText();
  16
  17             function crash() {
  18                 el0 = document.createElement('div');
  19                 el0.setAttribute('id', 'el0');
  20                 document.body.appendChild(el0);
  21                 el1 = document.createElement('div');
  22                 document.body.appendChild(el1);
  23                 el2 = document.createElement('div');
  24                 el2.setAttribute('id', 'el2');
  25                 el1.appendChild(el2);
  26                 el2.appendChild(document.createTextNode('A'));
  27                 el3 = document.createElement('input');
  28                 el3.setAttribute('id', 'el3');
  29                 el2.appendChild(el3);
  30                 document.body.style.zoom=2;
  31                 document.execCommand('selectall');
  32                 el2.style.display='table-header-group';
  33                 document.body.style.zoom=1;
  34             }
  35             window.onload=crash
  36         </script>
  37     </head>
  38     <body>
  39         <p> Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=74781">74781</a>: Crash in RenderFlowThread::getRegionRangeForBox</p>
  40         <p> This test PASSES if it does not CRASH or ASSERT.</p>
  41     </body>
  42 </html>