layout/generic/crashtests/350370.html@6474c204b198
layout/generic/crashtests/350370.html
Wed, 31 Dec 2014 06:09:35 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Wed, 31 Dec 2014 06:09:35 +0100
- changeset 0
- 6474c204b198
- permissions
- -rw-r--r--
Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.
1 <html><head>
2 <title>Testcase bug 350370 - Crash [@ nsStyleContext::FindChildWithRules] with ::first-line, appending rows and table-cells, etc</title>
3 <style>
4 #b td::first-line { font-size:110%;}
5 nobr::first-line { font-size:110%;}
7 #b td::after { content:"anonymous text"; }
8 nobr::after{ content:"anonymous text"; }
10 #b::before { content:"before text";}
11 #b td::before { content:"before text";}
12 </style>
13 </head>
14 <body>
15 <table style="display: table-row;"></table><nobr style="display: list-item; -moz-column-count: 2;">
16 <table id="b" style="display: inline;"></table>
17 </nobr>
18 <br>
19 This page should not crash Mozilla
20 <script>
21 function doe(){
22 var td = document.createElement('td');;
23 td.setAttribute('height', '50%');
24 var tr = document.createElement('tr');;
25 tr.setAttribute('height', '50%');
26 tr.appendChild(td);
27 document.getElementsByTagName('table')[1].appendChild(tr);
28 document.body.offsetHeight;
30 var td = document.createElement('td');;
31 td.setAttribute('height', '50%');
32 document.getElementsByTagName('tr')[0].appendChild(td);
33 document.body.offsetHeight;
35 var td = document.createElement('td');;
36 td.setAttribute('height', '50%');
37 document.getElementsByTagName('tr')[0].appendChild(td);
38 }
39 setTimeout(doe, 60);
40 </script>
41 </body>
42 </html>
