widget/cocoa/crashtests/464589-1.html

branch
TOR_BUG_9701
changeset 15
b8a032363ba2
equal deleted inserted replaced
-1:000000000000 0:19df0cc0607c
1 <html>
2 <head>
3 <script type="text/javascript">
4
5 function boom()
6 {
7 var o2 = document.createElement("option");
8 document.getElementById("o1").appendChild(o2);
9 o2.style.padding = "131072cm";
10 }
11
12 </script>
13 </head>
14
15 <body onload="boom();">
16
17 <select><option id="o1" style="height: 0cm;"></option></select>
18
19 </body>
20 </html>

mercurial