Do not create a shape object outside of the layout context
[WebKit-https.git] / LayoutTests / fast / block / float / float-not-removed-from-pre-block.html
1 <!DOCTYPE html>
2 <html>
3 Bug 101970: Heap-use-after-free in WebCore::RenderLayerModelObject::hasSelfPaintingLayer<br />
4 Test passes if it does not crash.<br />
5 <div id="container">
6   <q>
7     <q id="test1"></q>
8   </q>
9   <q id="test2">
10     <q style="float: left"></q>
11     <q id="test3">
12       <q style="position: fixed;">
13     </q>
14   </q>
15 </div>
16 <script>
17 if (window.testRunner)
18     testRunner.dumpAsText();
19
20 document.body.offsetTop;
21 test3.style.display = "table-footer-group";
22 test3.focus();
23 test1.style.display = "table-row-group";
24 test2.style.display = "inline-block";
25 </script>
26 </html>