recursive-split-flow-crash.html | Explore in Territory

<!DOCTYPE html>
<html>
Bug 101984: Heap-buffer-overflow in WebCore::LayoutBlockFlow::clone.<br />
Test passes if it does not crash.
<body>
<table>
<div class="container">
<div class="testClass" id="test1">
</div>
<div class="testClass">
<div>
<i id="test2"></i>
</div>
</div>
</div>
</table>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

document.head.appendChild(document.createElement("style"));
var styleSheet0 = document.styleSheets[0];
var test1 = document.getElementById("test1");
var test2 = document.getElementById("test2");


document.execCommand("SelectAll", true);
styleSheet0.insertRule('.testClass { -webkit-column-span: all ; }', 0);
test1.appendChild(test2);
styleSheet0.insertRule('.testClass::first-letter { border-style: none; }', 0);
</script>
</body>
</html>

chromium/third_party/blink/web_tests/fast/multicol/recursive-split-flow-crash.html