| <!DOCTYPE html> |
| <html> |
| <style> |
| .table { |
| display: table; |
| border-collapse: collapse; |
| } |
| .tableCell { |
| display: table-cell; |
| } |
| .tableRowGroup { |
| border-style: solid solid solid none; |
| display: table-row-group; |
| } |
| </style> |
| <body style="-webkit-writing-mode: vertical-rl;"> |
| <div class="table"> |
| A |
| <span id="span1"></span> |
| <span class="tableCell"></span> |
| <div> |
| </div> |
| <div class="tableRowGroup">B</div> |
| <script> |
| if (window.testRunner) |
| testRunner.dumpAsText(); |
| |
| document.body.offsetTop; |
| span1.style.display = "table-footer-group"; |
| |
| document.body.offsetTop; |
| document.body.innerHTML = "Bug <a href='https://bugs.webkit.org/show_bug.cgi?id=91160'>91160</a>: Crash in WebCore::LayoutTable::cellBefore<br>PASS. WebKit didn't crash"; |
| </script> |
| </body> |
| </html> |
