The Tor Browser: layout/tables/crashtests/110523-1.html@44a2da4a2ab2

Replace accessor implementation with direct member state manipulation, by
request https://trac.torproject.org/projects/tor/ticket/9701#comment:32

     1 <html>

     2 <head>

     3 <title></title>

     4 <script type="text/javascript">

     5 function toggle(b) {

     6 	var adv = document.getElementById("it_guru");

     7 	var ns = 'none';

     8 	if (b) {

     9 			ns= "table-row";

    10 	}

    11 	adv.style.display = ns;

    12 }

    13 function boom()

    14 {

    15   toggle(true);

    16   document.documentElement.offsetHeight;

    17   toggle(false);

    18   document.documentElement.offsetHeight;

    19   toggle(true);

    20   document.documentElement.offsetHeight;

    21   toggle(false);

    22   document.documentElement.offsetHeight;

    23 }

    24 </script></head><body onload="boom();">

    25 <form action="http://localhost/">

    26 <table>

    27 <tbody>

    28 <tr>

    29 <td>Without the &lt;tbody&gt; tags Mozilla doesn't crash

    30 		</td>

    31 </tr>

    32 </tbody>

    33 <tr id="it_guru">

    34 <td>I disappear

    35 		</td>

    36 </tr>

    37 <tr>

    38 <td>Without this row Mozilla doesn't crash

    39 		</td>

    40 </tr>

    41 </table>

    42 </form>

    43 </body>

    44 </html>

The Tor Browser / file revision