1.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000
1.2 +++ b/layout/generic/crashtests/417902-2.html Wed Dec 31 06:09:35 2014 +0100
1.3 @@ -0,0 +1,28 @@
1.4 +<html>
1.5 +<head>
1.6 + <style>
1.7 + div:first-letter {
1.8 + float: left;
1.9 + background: orange;
1.10 + }
1.11 + /* Note: there's an upper-bound on widths that trigger a crash.
1.12 + This bound depends on the width of the characters in the div. */
1.13 + div#v {
1.14 + -moz-column-count: 2;
1.15 + width: 30px;
1.16 + height: 1em;
1.17 + background: lightblue;
1.18 + }
1.19 + </style>
1.20 + <script>
1.21 + function boom() {
1.22 + var v = document.getElementById("v");
1.23 + // Note: This seems to crash regardless of what the text node is;
1.24 + // e.g. it can be the empty string, a space character, or any number of
1.25 + // other characters.
1.26 + v.appendChild(document.createTextNode("CRASH"));
1.27 + }
1.28 + </script>
1.29 +</head>
1.30 +<body onload="boom();"><div id="v">a b</div></body>
1.31 +</html>
