layout/generic/crashtests/350370.html@b8a032363ba2
layout/generic/crashtests/350370.html
Thu, 22 Jan 2015 13:21:57 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Thu, 22 Jan 2015 13:21:57 +0100
- branch
- TOR_BUG_9701
- changeset 15
- b8a032363ba2
- permissions
- -rw-r--r--
Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6
1 <html><head>
2 <title>Testcase bug 350370 - Crash [@ nsStyleContext::FindChildWithRules] with ::first-line, appending rows and table-cells, etc</title>
3 <style>
4 #b td::first-line { font-size:110%;}
5 nobr::first-line { font-size:110%;}
7 #b td::after { content:"anonymous text"; }
8 nobr::after{ content:"anonymous text"; }
10 #b::before { content:"before text";}
11 #b td::before { content:"before text";}
12 </style>
13 </head>
14 <body>
15 <table style="display: table-row;"></table><nobr style="display: list-item; -moz-column-count: 2;">
16 <table id="b" style="display: inline;"></table>
17 </nobr>
18 <br>
19 This page should not crash Mozilla
20 <script>
21 function doe(){
22 var td = document.createElement('td');;
23 td.setAttribute('height', '50%');
24 var tr = document.createElement('tr');;
25 tr.setAttribute('height', '50%');
26 tr.appendChild(td);
27 document.getElementsByTagName('table')[1].appendChild(tr);
28 document.body.offsetHeight;
30 var td = document.createElement('td');;
31 td.setAttribute('height', '50%');
32 document.getElementsByTagName('tr')[0].appendChild(td);
33 document.body.offsetHeight;
35 var td = document.createElement('td');;
36 td.setAttribute('height', '50%');
37 document.getElementsByTagName('tr')[0].appendChild(td);
38 }
39 setTimeout(doe, 60);
40 </script>
41 </body>
42 </html>
