e112514681
Count table-column descendants from the layout tree when forming a table grid. Generated table-column-group boxes can be layout-only and do not have a DOM node, so walking through the DOM subtree can crash during the table fixup pass. Add a crash test covering a generated table-column-group pseudo-element.
12 lines
190 B
HTML
12 lines
190 B
HTML
<!doctype html>
|
|
<style>
|
|
table::before {
|
|
content: "";
|
|
display: table-column-group;
|
|
}
|
|
</style>
|
|
<table>
|
|
<tbody>
|
|
<tr><td>cell</td></tr>
|
|
</tbody>
|
|
</table>
|