crash-beforeBorder-dirty-section.html

<!DOCTYPE html>
<html>
<head>
<style>
    #el1 {
        border-collapse: collapse;
        -webkit-writing-mode: vertical-rl;
    }
</style>
</head>
<body>
<script>
    if (window.testRunner)
        testRunner.dumpAsText();

    var wrapper = document.createElement('div');
    wrapper.style.display = 'inline-block';
    document.body.appendChild(wrapper);
    var table = document.createElement('table');
    table.setAttribute('id', 'el1');
    wrapper.appendChild(table);
    tbody = document.createElement('tbody');
    tbody.setAttribute('id', 'el2');
    table.appendChild(tbody);

    function crash() {
        tbody.style.display = 'table';
        document.body.innerHTML = "<a href='https://bugs.webkit.org/show_bug.cgi?id=75215'>Bug 75215: Crash in LayoutTable::borderBefore<a><br>This test has passed!";
    }

    window.addEventListener('load', crash, false);
</script>
</body>
</html>

chromium/third_party/blink/web_tests/fast/table/crash-beforeBorder-dirty-section.html