inline-box-append-child-crash.html | Explore in Territory

<html>
<body>
  <!-- [bug 93993] https://bugs.webkit.org/show_bug.cgi?id=98993 -->
  <!-- WebCore::LayoutBlockFlow::determineStartPosition crash -->
  <!-- If this test passes, no crash. We can see "PASS". -->
  <foo style="white-space:pre-wrap;">
    <sup>
      <foo id="root">
	a<foo style="position:fixed;"></foo><foo><label id="node">
	    a</label>
	</foo>
  </foo>
  </sup>
  </foo>
</body>
<script type="text/javascript">
if (window.testRunner)
    testRunner.dumpAsText();
document.body.offsetTop;
root.appendChild(node);
document.body.offsetTop;
document.body.innerHTML = 'PASS';
</script>
</html>

chromium/third_party/blink/web_tests/fast/inline/inline-box-append-child-crash.html