layout/generic/crashtests/309322-3.html@b8a032363ba2
layout/generic/crashtests/309322-3.html
Thu, 22 Jan 2015 13:21:57 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Thu, 22 Jan 2015 13:21:57 +0100
- branch
- TOR_BUG_9701
- changeset 15
- b8a032363ba2
- permissions
- -rw-r--r--
Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6
1 <html><head>
2 <title>Testcase3 bug 309322 - Evil testcase using multiple display:table-caption causes crash</title>
3 <style>
4 *[toggle_style],*[toggle_style1],*[toggle_style2],*[toggle_style3],*[toggle_style4]{
5 display:table-caption;
6 }
7 </style>
8 <script>
9 function doe(i){
10 var x=document.body.getElementsByTagName('*');
11 var xl=x.length;i=i+1;
12 x[i-1].removeAttribute('toggle_style');
13 x[i].setAttribute('toggle_style','toggle_style');
14 if ((i+1)<xl) {x[i+1].setAttribute('toggle_style1','toggle_style');
15 x[i].removeAttribute('toggle_style1');
16 }
17 if ((i+2)<xl) {x[i+2].setAttribute('toggle_style2','toggle_style');
18 x[i+1].removeAttribute('toggle_style2');
19 }
20 if ((i+3)<xl) {x[i+3].setAttribute('toggle_style3','toggle_style');
21 x[i+2].removeAttribute('toggle_style3');
22 }
23 if ((i+4)<xl) {x[i+4].setAttribute('toggle_style4','toggle_style');
24 x[i+3].removeAttribute('toggle_style4');
25 }
26 if ((i+4)==xl) {
27 x[i+3].removeAttribute('toggle_style4');
28 }
29 if ((i+3)==xl) {
30 x[i+2].removeAttribute('toggle_style3');
31 }
32 if ((i+2)==xl) {
33 x[i+1].removeAttribute('toggle_style2');
34 }
35 if ((i+1)==xl) {
36 x[i].removeAttribute('toggle_style1');
37 }
38 setTimeout(doe,20,i);
39 }
42 </script></head><body onload="doe(3)">
43 <button onclick="doe(3)">Clicking on this button should not create extra "Galloway" text</button>
44 <table><tbody><tr><td>
45 <span><br></span>
46 <a href="#">Galloway</a>
47 </td></tr></tbody></table>
48 </body></html>
