table-cell-should-clip-overflow-crash.html

<!DOCTYPE html>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<table>
    <tbody>
        <tr>
            <td id="rowspanned" rowspan="2"></td>
        </tr>
        <tr id="removeMe"></tr>
    </tbody>
</table>
<script>
    test(() => {
        var rowspanned = document.getElementById("rowspanned");
        var removeMe = document.getElementById("removeMe");

        // First trigger a layout pass, to build and lay out what we already have.
        document.body.offsetTop;

        // Then remove the second table row. This will trigger SetNeedsCellRecalc()
        // on the table section. Many operations on the table will now be dangerous
        // (because there might be dangling pointers), until we have recalculated
        // the data structures (by calling RecalcCells()). Unless someone explicitly
        // demands this to be done, this recalculation won't happen until the next
        // layout pass.
        removeMe.parentNode.removeChild(removeMe);

        // Before we actually get around to updating the data structures in the
        // table, change some arbitrary style on the table cell to trigger
        // StyleDidChange() on the cell, which will call ShouldClipOverflow().
        rowspanned.style.color = "blue";
    }, "No crash or assertion failure. crbug.com/750016");
</script>
chromium/third_party/blink/web_tests/fast/table/table-cell-should-clip-overflow-crash.html
