layout/generic/crashtests/417902-2.html@b8a032363ba2 (annotated)
layout/generic/crashtests/417902-2.html
Thu, 22 Jan 2015 13:21:57 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Thu, 22 Jan 2015 13:21:57 +0100
- branch
- TOR_BUG_9701
- changeset 15
- b8a032363ba2
- permissions
- -rw-r--r--
Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6
| michael@0 | 1 | <html> |
| michael@0 | 2 | <head> |
| michael@0 | 3 | <style> |
| michael@0 | 4 | div:first-letter { |
| michael@0 | 5 | float: left; |
| michael@0 | 6 | background: orange; |
| michael@0 | 7 | } |
| michael@0 | 8 | /* Note: there's an upper-bound on widths that trigger a crash. |
| michael@0 | 9 | This bound depends on the width of the characters in the div. */ |
| michael@0 | 10 | div#v { |
| michael@0 | 11 | -moz-column-count: 2; |
| michael@0 | 12 | width: 30px; |
| michael@0 | 13 | height: 1em; |
| michael@0 | 14 | background: lightblue; |
| michael@0 | 15 | } |
| michael@0 | 16 | </style> |
| michael@0 | 17 | <script> |
| michael@0 | 18 | function boom() { |
| michael@0 | 19 | var v = document.getElementById("v"); |
| michael@0 | 20 | // Note: This seems to crash regardless of what the text node is; |
| michael@0 | 21 | // e.g. it can be the empty string, a space character, or any number of |
| michael@0 | 22 | // other characters. |
| michael@0 | 23 | v.appendChild(document.createTextNode("CRASH")); |
| michael@0 | 24 | } |
| michael@0 | 25 | </script> |
| michael@0 | 26 | </head> |
| michael@0 | 27 | <body onload="boom();"><div id="v">a b</div></body> |
| michael@0 | 28 | </html> |
