Mypal/layout/generic/crashtests/350370.html

42 lines
1.3 KiB
HTML

<html><head>
<title>Testcase bug 350370 - Crash [@ nsStyleContext::FindChildWithRules] with ::first-line, appending rows and table-cells, etc</title>
<style>
#b td::first-line { font-size:110%;}
nobr::first-line { font-size:110%;}
#b td::after { content:"anonymous text"; }
nobr::after{ content:"anonymous text"; }
#b::before { content:"before text";}
#b td::before { content:"before text";}
</style>
</head>
<body>
<table style="display: table-row;"></table><nobr style="display: list-item; -moz-column-count: 2;">
<table id="b" style="display: inline;"></table>
</nobr>
<br>
This page should not crash Mozilla
<script>
function doe(){
var td = document.createElement('td');;
td.setAttribute('height', '50%');
var tr = document.createElement('tr');;
tr.setAttribute('height', '50%');
tr.appendChild(td);
document.getElementsByTagName('table')[1].appendChild(tr);
document.body.offsetHeight;
var td = document.createElement('td');;
td.setAttribute('height', '50%');
document.getElementsByTagName('tr')[0].appendChild(td);
document.body.offsetHeight;
var td = document.createElement('td');;
td.setAttribute('height', '50%');
document.getElementsByTagName('tr')[0].appendChild(td);
}
setTimeout(doe, 60);
</script>
</body>
</html>