table-split-positioned-object-crash.html

<!DOCTYPE html>
<html>
WebKit Bug 89599 - Crash in LayoutBlockFlow::layoutPositionedObjects.<br />
Test passes if it does not crash.
<style>
table { position: relative; }
.span:last-child { position: relative; }
</style>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

function crash() {
    table = document.createElement('table');
    document.documentElement.appendChild(table);
    
    span1 = document.createElement('span');
    span2 = document.createElement('span');
    span3 = document.createElement('span');
    span3.setAttribute('class', 'span');
    span4 = document.createElement('span');
    span4.style.position = 'absolute';
    span3.appendChild(span4);

    table.appendChild(span1);
    table.appendChild(span2);
    table.appendChild(span3);

    document.documentElement.offsetTop;
    span2.style.display = 'table-header-group';
    span3.style.display = 'block'
}
window.onload = crash;
</script>
</html>

chromium/third_party/blink/web_tests/fast/table/table-split-positioned-object-crash.html