intruding-floats-crash.html | Explore in Territory

<html>
<head>
<style>
    .c3 { text-decoration: inherit; border-style: dotted; }
    .c6:only-of-type { position: relative; content: url(data:text/plain,aaa); }
    .c6 + .c3 { display: table-row; float: right; }
    .c6[class^="c6"] { overflow: auto; }
    .c7:nth-last-of-type(odd) { float: right; width: 100%; }
    .c7:nth-last-child(2n) { display: -wap-marquee; float: none; }
    .c7[class$="c7"] { content: url(data:text/plain,aaa); }
    .c8 { display: compact; -webkit-column-count: 65536; }
    .c8:first-of-type { float: none; -webkit-column-span: all;}
</style>
<script>
if (window.testRunner) {
    testRunner.waitUntilDone();
    testRunner.dumpAsText();
}

var nodes = Array();

function tryToCrash()
{
    document.body.OffsetTop;
    setTimeout('testRunner.notifyDone();',10);
}

function boom() {
    try { nodes[8] = document.createElement('nav'); } catch(e) {}
    try { nodes[12] = document.createElement('ins'); } catch(e) {}
    try { nodes[48] = document.createElement('button'); } catch(e) {}
    try { document.documentElement.appendChild(nodes[48]); } catch(e) {}
    try { nodes[59] = document.createElement('sub'); } catch(e) {}
    try { nodes[59].setAttribute('class', 'c7'); } catch(e) {}
    try { document.documentElement.appendChild(nodes[59]); } catch(e) {}
    try { nodes[65] = document.createElement('b'); } catch(e) {}
    try { nodes[65].setAttribute('class', 'c6'); } catch(e) {}
    try { document.documentElement.appendChild(nodes[65]); } catch(e) {}
    try { nodes[66] = document.createElement('tbody'); } catch(e) {}
    try { nodes[66].setAttribute('class', 'c3'); } catch(e) {}
    try { document.documentElement.appendChild(nodes[66]); } catch(e) {}
    try { nodes[68] = document.createElement('button'); } catch(e) {}
    try { document.documentElement.appendChild(nodes[68]); } catch(e) {}
    try { nodes[77] = document.createElement('i'); } catch(e) {}
    try { document.documentElement.appendChild(nodes[77]); } catch(e) {}
    try { nodes[78] = document.createElement('aside'); } catch(e) {}
    try { document.documentElement.appendChild(nodes[78]); } catch(e) {}
    try { nodes[84] = document.createElement('nav'); } catch(e) {}
    try { nodes[84].setAttribute('class', 'c8'); } catch(e) {}
    try { nodes[86] = document.createElement('colgroup'); } catch(e) {}
    try { document.documentElement.appendChild(nodes[86]); } catch(e) {}
    setTimeout('try { nodes[12].appendChild(nodes[65]); } catch(e) {}', 5);
    setTimeout('try { nodes[8].appendChild(nodes[86]); } catch(e) {}', 4);
    setTimeout("try { nodes[68].setAttribute('class', 'c8'); } catch(e) {}", 2);
    setTimeout('try { nodes[68].appendChild(nodes[84]); } catch(e) {}', 3);
    setTimeout('document.execCommand("SelectAll", false, "");', 1);
    setTimeout('tryToCrash();', 6);
}
    window.onload = boom;
</script>
</head>
<body>
Passes if it doesn't crash!
</body>
</html>
chromium/third_party/blink/web_tests/fast/css/intruding-floats-crash.html
