| <!DOCTYPE html> |
| <script src="../../resources/testharness.js"></script> |
| <script src="../../resources/testharnessreport.js"></script> |
| <table> |
| <tbody> |
| <tr> |
| <td id="rowspanned" rowspan="2"></td> |
| </tr> |
| <tr id="removeMe"></tr> |
| </tbody> |
| </table> |
| <script> |
| test(() => { |
| var rowspanned = document.getElementById("rowspanned"); |
| var removeMe = document.getElementById("removeMe"); |
| |
| // First trigger a layout pass, to build and lay out what we already have. |
| document.body.offsetTop; |
| |
| // Then remove the second table row. This will trigger SetNeedsCellRecalc() |
| // on the table section. Many operations on the table will now be dangerous |
| // (because there might be dangling pointers), until we have recalculated |
| // the data structures (by calling RecalcCells()). Unless someone explicitly |
| // demands this to be done, this recalculation won't happen until the next |
| // layout pass. |
| removeMe.parentNode.removeChild(removeMe); |
| |
| // Before we actually get around to updating the data structures in the |
| // table, change some arbitrary style on the table cell to trigger |
| // StyleDidChange() on the cell, which will call ShouldClipOverflow(). |
| rowspanned.style.color = "blue"; |
| }, "No crash or assertion failure. crbug.com/750016"); |
| </script> |
