The Tor Browser / file comparison
comparison: layout/generic/crashtests/417902-2.html
layout/generic/crashtests/417902-2.html
- changeset 0
- 6474c204b198
equal
deleted
inserted
replaced
| -1:000000000000 | 0:c1e18247e264 |
|---|---|
| 1 <html> | |
| 2 <head> | |
| 3 <style> | |
| 4 div:first-letter { | |
| 5 float: left; | |
| 6 background: orange; | |
| 7 } | |
| 8 /* Note: there's an upper-bound on widths that trigger a crash. | |
| 9 This bound depends on the width of the characters in the div. */ | |
| 10 div#v { | |
| 11 -moz-column-count: 2; | |
| 12 width: 30px; | |
| 13 height: 1em; | |
| 14 background: lightblue; | |
| 15 } | |
| 16 </style> | |
| 17 <script> | |
| 18 function boom() { | |
| 19 var v = document.getElementById("v"); | |
| 20 // Note: This seems to crash regardless of what the text node is; | |
| 21 // e.g. it can be the empty string, a space character, or any number of | |
| 22 // other characters. | |
| 23 v.appendChild(document.createTextNode("CRASH")); | |
| 24 } | |
| 25 </script> | |
| 26 </head> | |
| 27 <body onload="boom();"><div id="v">a b</div></body> | |
| 28 </html> |
