REGRESSION (r167879): Heap-use-after-free in WebCore::RenderFlexibleBox
[WebKit-https.git] / LayoutTests / fast / flexbox / order-iterator-crash.html
1 <div>This test has passed if it doesn't crash.</div>
2 <style>
3 * { display: -webkit-flex; }
4 </style>
5 <table><td id="crashy"></td></table>
6 <script>
7 if (window.testRunner)
8     testRunner.dumpAsText();
9
10 crashy.offsetLeft;
11 crashy.parentNode.removeChild(crashy);
12 </script>