summaryrefslogtreecommitdiffstats
path: root/layout/base/crashtests/325024.html
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--layout/base/crashtests/325024.html20
1 files changed, 20 insertions, 0 deletions
diff --git a/layout/base/crashtests/325024.html b/layout/base/crashtests/325024.html
new file mode 100644
index 0000000000..6f9aba509e
--- /dev/null
+++ b/layout/base/crashtests/325024.html
@@ -0,0 +1,20 @@
+<html><head>
+<title>Testcase bug 325024 - Crash with evil testcase, using object, display: table-column, etc</title>
+</head>
+<body>
+<object>
+<div>Mozilla should not crash on this page</div>
+<span style="display: table-column;">
+<span style="display: block;"></span>
+</span><span style="display: table-cell;">
+</span>
+<isindex style="position: absolute; ">
+</object>
+
+<script>
+document.body.getElementsByTagName('*')[2].removeAttribute('style');
+document.body.offsetHeight;
+document.body.getElementsByTagName('*')[3].removeAttribute('style');
+document.body.offsetHeight;
+</script>
+</body></html>