layout/generic/crashtests/534366-2.html@6474c204b198
layout/generic/crashtests/534366-2.html
Wed, 31 Dec 2014 06:09:35 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Wed, 31 Dec 2014 06:09:35 +0100
- changeset 0
- 6474c204b198
- permissions
- -rw-r--r--
Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.
1 <html>
2 <head>
3 <style type="text/css">
5 body { font-family: monospace; width: 4ch; }
6 body::first-line { }
7 body *::before { content: 'w';}
9 </style>
11 <script type="text/javascript">
13 function boom()
14 {
15 var de = document.documentElement;
16 var body = document.body;
18 var span = document.createElementNS("http://www.w3.org/1999/xhtml", "span");
19 var r1 = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mrow");
20 var mmm = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mmultiscripts");
22 body.appendChild(span);
23 r1.appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", "mrow"));
24 body.appendChild(r1);
25 body.appendChild(mmm);
26 de.offsetHeight;
27 r1.appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", 'mrow'));
28 de.offsetHeight;
29 mmm.appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", 'mrow'));
30 de.offsetHeight;
32 document.removeChild(de);
33 document.appendChild(de);
34 de.offsetHeight;
35 }
37 window.addEventListener("load", boom, false);
39 </script>
40 </head>
41 <body></body>
42 </html>
