gfx/tests/crashtests/487724-1.html

branch
TOR_BUG_3246
changeset 7
129ffea94266
equal deleted inserted replaced
-1:000000000000 0:a84e1fe60ef0
1 <!DOCTYPE html>
2 <html>
3 <head>
4 <script type="text/javascript">
5
6 function boom()
7 {
8 var w = document.getElementById("w");
9 var q = document.getElementById("q");
10 var e = document.createTextNode("");
11 document.documentElement.appendChild(document.body);
12 w.appendChild(e);
13 document.documentElement.offsetHeight;
14 w.removeChild(q);
15 document.documentElement.offsetHeight;
16 e.data += " x ";
17 }
18
19 </script>
20 </head>
21
22 <body onload="boom();"><span id="w">s&#x202E;<span id="q"></span><div></div><span>a</span></span></body>
23 </html>

mercurial