rubybase-children-made-inline-crash.html

<!DOCTYPE html>
<script>
function characterDataModified() {
  var oElement = event.srcElement;
  oElement.parentNode.removeChild(oElement);
  document.execCommand('SelectWord',false,false);
}
document.addEventListener("DOMCharacterDataModified", characterDataModified, true);
function nodeInserted() {
  var oElement = event.srcElement;
  oElement.insertAdjacentText('beforebegin', 'xxxo`i$&qqq^pppMmmCCCCCCCCCCCC("');
  document.execCommand('Undo',false,false);
  oElement.outerHTML = "";
}
document.addEventListener("DOMNodeInserted", nodeInserted, false);
if (window.testRunner)
  testRunner.dumpAsText();
</script>
<style id="style">
  .inline-block { display:inline-block; }
  .float { float:left; }
  .table-footer { display:table-footer-group; }
</style>
<p>crbug.com/658584: Clear floats when a ruby column's children are made inline. This test passes if it does not crash.</p>
<div id="test"></div>
<ruby>
  <rbc>
    <rb class="float">
      AAA
    </rb>
  </rbc>
  <rt class="inline-block"></rt>
  <rtc class="table-footer"></rtc>
</ruby>
<script>
  document.body.offsetTop;
  var oElement = document.getElementById("test");
  var oParent = document.getElementById("style");
  var oPreviousSibling = oParent.childNodes[0];
  oParent.insertBefore(oElement, oPreviousSibling)
</script>

chromium/third_party/blink/web_tests/dom/mutation-event-tests/fast/block/float/rubybase-children-made-inline-crash.html