| <!DOCTYPE html> |
| <html> |
| <script type="text/javascript"> |
| if (window.testRunner) |
| testRunner.dumpAsText(); |
| </script> |
| <body> |
| <h3>Test for chromium bug : <a href="https://code.google.com/p/chromium/issues/detail?id=296003">296003</a>. Heap-buffer-overflow in void std::__final_insertion_sort.</h3> |
| <h4>For this test to PASS, it should not crash.</h4> |
| <table border="1"> |
| <tr> |
| <td rowspan=3>row0col0 (rowspan=3)</td> |
| <td rowspan=3>row0col1 (rowspan=3)</td> |
| <td rowspan=6>row0col2 (rowspan=6)</td> |
| <td rowspan=4>row0col3 (rowspan=4)</td> |
| <td rowspan=16>row0col4 (rowspan=16)</td> |
| <td rowspan=4>row0col5 (rowspan=4)</td> |
| <td rowspan=12>row0col6 (rowspan=12)</td> |
| <td rowspan=4>row0col7 (rowspan=4)</td> |
| <td rowspan=12>row0col8 (rowspan=12)</td> |
| </tr> |
| <tr> |
| <td>row1col9</td> |
| </tr> |
| <tr> |
| <td rowspan=3>row2col9 (rowspan=3)</td> |
| <td rowspan=8>row2col10 (rowspan=8)</td> |
| <td rowspan=8>row2col11 (rowspan=8)</td> |
| <td rowspan=8>row2col12 (rowspan=8)</td> |
| <td rowspan=8>row2col13 (rowspan=8)</td> |
| </tr> |
| <tr> |
| <td>row3col0</td> |
| </tr> |
| <tr> |
| <td rowspan=4>row4col0 (rowspan=4)</td> |
| <td rowspan=370>row4col1 (rowspan=370)</td> |
| </tr> |
| <tr> |
| <td>row5col3</td> |
| </tr> |
| <tr> |
| <td>row6col2</td> |
| </tr> |
| <tr> |
| <td rowspan=6>row7col2 (rowspan=6)</td> |
| <td rowspan=6>row7col3 (rowspan=6)</td> |
| </tr> |
| <tr> |
| <td rowspan=4>row8col0 (rowspan=4)</td> |
| <td rowspan=12>row8col5 (rowspan=12)</td> |
| <td rowspan=16>row8col7 (rowspan=16)</td> |
| <td rowspan=179>row8col9 (rowspan=179)</td> |
| <td rowspan=33>row8col14 (rowspan=33)</td> |
| </tr> |
| <tr> |
| <td rowspan=35>row9col15 (rowspan=35)</td> |
| <td rowspan=3>row9col16 (rowspan=3)</td> |
| <td rowspan=6>row9col17 (rowspan=6)</td> |
| <td rowspan=24>row9col18 (rowspan=24)</td> |
| <td rowspan=19>row9col19 (rowspan=19)</td> |
| <td rowspan=3>row9col20 (rowspan=3)</td> |
| <td rowspan=13>row9col21 (rowspan=13)</td> |
| <td rowspan=22>row9col22 (rowspan=22)</td> |
| <td rowspan=5>row9col23 (rowspan=5)</td> |
| <td rowspan=20>row9col24 (rowspan=20)</td> |
| </tr> |
| </table> |
| </body> |
| </html> |
