Wed, 31 Dec 2014 07:16:47 +0100
Revert simplistic fix pending revisit of Mozilla integration attempt.
1 <!DOCTYPE html>
2 <html>
3 <head>
4 <script>
6 function boom()
7 {
8 // Only this exact number of calls to bounce() triggers the bug,
9 // but changing the depth of the document changes the number of
10 // bounce() calls needed. For example, removing the 'p' tag
11 // makes it so one additional bounce() is needed.
13 for (var i = 0; i < 7; ++i)
14 bounce();
16 var tr = document.getElementById("tr");
17 tr.style.display = "none";
18 document.documentElement.offsetHeight;
19 bounce();
20 document.documentElement.offsetHeight;
21 tr.style.display = "";
23 document.documentElement.offsetHeight;
25 var td = document.getElementById("td");
26 td.style.display = "none";
27 document.documentElement.offsetHeight;
28 bounce();
29 document.documentElement.offsetHeight;
30 td.style.display = "";
31 }
34 function bounce()
35 {
36 var docElem = document.documentElement;
37 var docElemChildren = [];
38 while (docElem.firstChild) {
39 docElemChildren.push(docElem.firstChild);
40 docElem.removeChild(docElem.firstChild);
41 }
43 for (var i = 0; i < docElemChildren.length; ++i)
44 docElem.appendChild(docElemChildren[i]);
45 }
47 </script>
49 <style type="text/css">
50 #a { color: orange; }
51 #b { color: blue; }
52 </style>
54 </head>
56 <body onload="boom();">
57 <table border="10"><tr id="tr"><td id="td">
58 <p><span id="a">a</span><span id="b">b</span></p>
59 </td></tr></table>
60 </body>
62 </html>