1.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000
1.2 +++ b/layout/generic/crashtests/350370.html Wed Dec 31 06:09:35 2014 +0100
1.3 @@ -0,0 +1,42 @@
1.4 +<html><head>
1.5 +<title>Testcase bug 350370 - Crash [@ nsStyleContext::FindChildWithRules] with ::first-line, appending rows and table-cells, etc</title>
1.6 +<style>
1.7 +#b td::first-line { font-size:110%;}
1.8 +nobr::first-line { font-size:110%;}
1.9 +
1.10 +#b td::after { content:"anonymous text"; }
1.11 +nobr::after{ content:"anonymous text"; }
1.12 +
1.13 +#b::before { content:"before text";}
1.14 +#b td::before { content:"before text";}
1.15 +</style>
1.16 +</head>
1.17 +<body>
1.18 +<table style="display: table-row;"></table><nobr style="display: list-item; -moz-column-count: 2;">
1.19 +<table id="b" style="display: inline;"></table>
1.20 +</nobr>
1.21 +<br>
1.22 +This page should not crash Mozilla
1.23 +<script>
1.24 +function doe(){
1.25 + var td = document.createElement('td');;
1.26 + td.setAttribute('height', '50%');
1.27 + var tr = document.createElement('tr');;
1.28 + tr.setAttribute('height', '50%');
1.29 + tr.appendChild(td);
1.30 + document.getElementsByTagName('table')[1].appendChild(tr);
1.31 + document.body.offsetHeight;
1.32 +
1.33 + var td = document.createElement('td');;
1.34 + td.setAttribute('height', '50%');
1.35 + document.getElementsByTagName('tr')[0].appendChild(td);
1.36 + document.body.offsetHeight;
1.37 +
1.38 + var td = document.createElement('td');;
1.39 + td.setAttribute('height', '50%');
1.40 + document.getElementsByTagName('tr')[0].appendChild(td);
1.41 +}
1.42 +setTimeout(doe, 60);
1.43 +</script>
1.44 +</body>
1.45 +</html>
1.46 \ No newline at end of file
