Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(449)

Side by Side Diff: LayoutTests/fast/table/multiple-captions-crash4.html

Issue 9250021: Merge 105120 - Heap-use-after-free in WebCore::RenderBlock::selectionGaps (Closed) Base URL: http://svn.webkit.org/repository/webkit/branches/chromium/912/
Patch Set: Created 8 years, 11 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 <html> 1 <html>
2 <head> 2 <head>
3 <style> 3 <style>
4 .c10 { display: table-caption; width: 65536px; } 4 .c10 { display: table-caption; width: 65536px; }
5 .c12 > .c7 { visibility: hidden; float: left; } 5 .c12 > .c7 { visibility: hidden; float: left; }
6 .c13:nth-of-type(2n) { color: Yellow; } 6 .c13:nth-of-type(2n) { color: Yellow; }
7 .c15:nth-last-of-type(-n+6) { display: -webkit-box; padding-left: 65536px; } 7 .c15:nth-last-of-type(-n+6) { display: -webkit-box; padding-left: 65536px; }
8 </style> 8 </style>
9 9
10 <script> 10 <script>
(...skipping 29 matching lines...) Expand all
40 setTimeout('try { nodes[91].appendChild(nodes[8]); } catch(e) {}', 502); 40 setTimeout('try { nodes[91].appendChild(nodes[8]); } catch(e) {}', 502);
41 setTimeout('try { nodes[92].appendChild(nodes[16]); } catch(e) {}', 461); 41 setTimeout('try { nodes[92].appendChild(nodes[16]); } catch(e) {}', 461);
42 setTimeout('tryToCrash();', 519); 42 setTimeout('tryToCrash();', 519);
43 } 43 }
44 </script> 44 </script>
45 </head> 45 </head>
46 <body onLoad="setTimeout('boom();',0)"> 46 <body onLoad="setTimeout('boom();',0)">
47 Passes if it doesn't crash! 47 Passes if it doesn't crash!
48 </body> 48 </body>
49 </html> 49 </html>
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698