layout/generic/crashtests/417902-2.html@6474c204b198
layout/generic/crashtests/417902-2.html
Wed, 31 Dec 2014 06:09:35 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Wed, 31 Dec 2014 06:09:35 +0100
- changeset 0
- 6474c204b198
- permissions
- -rw-r--r--
Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.
1 <html>
2 <head>
3 <style>
4 div:first-letter {
5 float: left;
6 background: orange;
7 }
8 /* Note: there's an upper-bound on widths that trigger a crash.
9 This bound depends on the width of the characters in the div. */
10 div#v {
11 -moz-column-count: 2;
12 width: 30px;
13 height: 1em;
14 background: lightblue;
15 }
16 </style>
17 <script>
18 function boom() {
19 var v = document.getElementById("v");
20 // Note: This seems to crash regardless of what the text node is;
21 // e.g. it can be the empty string, a space character, or any number of
22 // other characters.
23 v.appendChild(document.createTextNode("CRASH"));
24 }
25 </script>
26 </head>
27 <body onload="boom();"><div id="v">a b</div></body>
28 </html>
