bug-106384.html | Explore in Territory

<!DOCTYPE html>

<style>
ruby:after {
    display: block;
    content: "";
}
</style>

<p>
    Bug 106384: Heap-use-after-free in WebCore::LayoutObject::willBeRemovedFromTree.
</p>

<script>
if (window.testRunner)
    testRunner.dumpAsText();

onload = function() {
    var ruby = document.createElement('ruby');
    document.body.appendChild(ruby);
    // Cause a layout.
    document.body.offsetLeft;
    ruby.appendChild(document.createTextNode('Passed if this test did not crash or assert.'));
};
</script>

chromium/third_party/blink/web_tests/fast/css-generated-content/bug-106384.html