<html>
<head>
<style>
#test1 { 
    height: 1px; 
    -webkit-writing-mode: vertical-rl;
}
#test1:nth-child(3) { 
    height: auto; 
}
</style>
<script>
if (window.testRunner)
    testRunner.dumpAsText();
 
onload = function() {
    document.body.appendChild(document.createElement('form'));
    test1 = document.createElement('input');
    test1.setAttribute('id', 'test1');
    test1.setAttribute('type', 'range');
    document.body.appendChild(test1);
    document.designMode = 'on';
    document.execCommand('selectall');
    document.execCommand('FormatBlock', false, '<'+'pre>');
    document.body.offsetTop;
    document.body.innerHTML = "WebKit bug 88017 - Crash due to renderer not removed from height descendant map.<br />PASS. WebKit didn't crash.";
}
</script>
</head>
<body>
</body>
</html>