summaryrefslogtreecommitdiffstats
path: root/layout/base/crashtests/322678.html
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--layout/base/crashtests/322678.html27
1 files changed, 27 insertions, 0 deletions
diff --git a/layout/base/crashtests/322678.html b/layout/base/crashtests/322678.html
new file mode 100644
index 0000000000..dffa35d006
--- /dev/null
+++ b/layout/base/crashtests/322678.html
@@ -0,0 +1,27 @@
+<!-- Quirks mode on purpose -->
+<html>
+ <head>
+ <title>Testcase bug 322678 - Crash [@ nsIFrame::GetParent] with evil testcase position:relative/absolute/display:table-column, etc</title>
+ <script>
+ function run(){
+ document.body.offsetHeight;
+ document.getElementById('one').removeAttribute('style');
+ document.body.offsetHeight;
+ document.getElementById('two').removeAttribute('style');
+ document.body.offsetHeight;
+ }
+ </script>
+ </head>
+ <body onload="run();">
+ <span>
+ <div style="position: relative;">
+ <span style="position: absolute;"></span>
+ </div>
+
+ <span id="one" style="display: table-column;">
+ <span id="two" style="display: block; position: relative;">
+ </span>
+ </span><u style="display: table-cell;"> </u>
+ </span>
+ </body>
+</html>