layout/tables/crashtests/344000-1.html

   1 <html xmlns="http://www.w3.org/1999/xhtml">
   2 <head>
   3     <title>dom cellmap crash</title>
   4
   5
   6
   7 <script>
   8 function doit()
   9 {
  10   var doc = window.document;
  11   var t1= doc.getElementById('table1');
  12   var tbA =  doc.createElement('tbody');
  13   t1.appendChild(tbA);
  14   var trA = doc.createElement('tr');
  15   var td = doc.createElement('td');
  16   td.setAttribute('rowspan', 2);
  17   trA.appendChild(td);
  18   tbA.appendChild(trA);
  19   var trB = doc.createElement('tr');
  20   var tdB = doc.createElement('td');
  21   tdB.setAttribute('rowspan', 2);
  22   trB.appendChild(tdB);
  23   tbA.appendChild(trB);
  24   tdB.remove();
  25   trA.remove();
  26   trB.remove();
  27   var tb =  doc.createElement('tbody');
  28   trB.appendChild(tdB);
  29   tb.appendChild(trB);
  30   t1.appendChild(tb);
  31 }
  32 </script>
  33
  34 </head>
  35
  36 <body onload="doit()">
  37
  38 <table id="table1"><tbody id="tbody1"><tr id="tr1"><td id="td1">x</td></tr></tbody></table>
  39
  40
  41
  42
  43 </body>
  44
  45 </html>