layout/generic/crashtests/309322-4.html@6474c204b198
layout/generic/crashtests/309322-4.html
Wed, 31 Dec 2014 06:09:35 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Wed, 31 Dec 2014 06:09:35 +0100
- changeset 0
- 6474c204b198
- permissions
- -rw-r--r--
Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.
1 <html><head>
2 <title>Testcase4 bug 309322 - Evil testcase using multiple display:table-caption causes crash</title>
3 <style>
4 *[toggle_style],*[toggle_style1],*[toggle_style2],*[toggle_style3],*[toggle_style4]{
5 display:table-caption;
6 }
7 </style>
8 <script>
9 function doe(i){
10 var x=document.body.getElementsByTagName('*');
11 var xl=x.length;i=i+1;
12 x[i-1].removeAttribute('toggle_style');
13 x[i].setAttribute('toggle_style','toggle_style');
14 if ((i+1)<xl) {x[i+1].setAttribute('toggle_style1','toggle_style');
15 x[i].removeAttribute('toggle_style1');
16 }
17 if ((i+2)<xl) {x[i+2].setAttribute('toggle_style2','toggle_style');
18 x[i+1].removeAttribute('toggle_style2');
19 }
20 if ((i+3)<xl) {x[i+3].setAttribute('toggle_style3','toggle_style');
21 x[i+2].removeAttribute('toggle_style3');
22 }
23 if ((i+4)<xl) {x[i+4].setAttribute('toggle_style4','toggle_style');
24 x[i+3].removeAttribute('toggle_style4');
25 }
26 if ((i+4)==xl) {
27 x[i+3].removeAttribute('toggle_style4');
28 }
29 if ((i+3)==xl) {
30 x[i+2].removeAttribute('toggle_style3');
31 }
32 if ((i+2)==xl) {
33 x[i+1].removeAttribute('toggle_style2');
34 }
35 if ((i+1)==xl) {
36 x[i].removeAttribute('toggle_style1');
37 }
38 setTimeout(doe,20,i);
39 }
42 </script></head><body onload="doe(3)">
43 <button onclick="doe(3)">Clicking on this button and then closing this tab/window should not crash Mozilla</button>
44 <table><tbody><tr><td>
45 <span><br></span>
46 <a href="#"><img src="https://bugzilla.mozilla.org/attachment.cgi?id=165273"></a>
47 </td></tr></tbody></table>
48 </body></html>
