diff options
Diffstat (limited to 'layout/generic/crashtests/534366-2.html')
| -rw-r--r-- | layout/generic/crashtests/534366-2.html | 42 |
1 files changed, 42 insertions, 0 deletions
diff --git a/layout/generic/crashtests/534366-2.html b/layout/generic/crashtests/534366-2.html new file mode 100644 index 0000000000..ef4cb50c38 --- /dev/null +++ b/layout/generic/crashtests/534366-2.html @@ -0,0 +1,42 @@ +<html> +<head> +<style type="text/css"> + +body { font-family: monospace; width: 4ch; } +body::first-line { } +body *::before { content: 'w';} + +</style> + +<script type="text/javascript"> + +function boom() +{ + var de = document.documentElement; + var body = document.body; + + var span = document.createElementNS("http://www.w3.org/1999/xhtml", "span"); + var r1 = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mrow"); + var mmm = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mmultiscripts"); + + body.appendChild(span); + r1.appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", "mrow")); + body.appendChild(r1); + body.appendChild(mmm); + de.offsetHeight; + r1.appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", 'mrow')); + de.offsetHeight; + mmm.appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", 'mrow')); + de.offsetHeight; + + document.removeChild(de); + document.appendChild(de); + de.offsetHeight; +} + +window.addEventListener("load", boom); + +</script> +</head> +<body></body> +</html> |