blob: db29e1424d96d39f0df31bed3057dcf99f9879d2 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
|
<!DOCTYPE html>
<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1439692">
<style>
body, fieldset { contain: strict; }
</style>
<script>
function crash() {
document.body.offsetTop;
document.body.appendChild(document.createElement("fieldset"));
}
</script>
<body onload="crash()">
|
