blob: 3fb9c974d6d447dc18d9cb121f770cddb8ba939c (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
|
<!DOCTYPE html>
<html>
<head>
<title>CSS 2.1 Test Suite: :first-letter</title>
<link rel="author" title="Boris Zbarsky" href="mailto:bzbarsky@mit.edu" />
<link rel="author" title="Mozilla Corporation" href="http://mozilla.com/" />
<link rel="help" href="http://www.w3.org/TR/CSS21/selector.html#first-letter"/>
<meta name="flags" content="dom" />
<script>
function boom1()
{
initFuzzerSpecific();
setTextContent(stylesheets[1], "*:first-letter { }");
setTextContent(stylesheets[2], "*:before { counter-reset: chicken; }");
document.body.offsetWidth;
boom2();
}
function boom2()
{
setTextContent(stylesheets[3], "#q2:first-letter { content: 'generated'; }");
setTextContent(stylesheets[1], "");
setTextContent(stylesheets[4], "#q2 { quotes: '<1>' '</1>'; }");
document.body.offsetWidth;
boom3();
}
function boom3()
{
document.getElementById("p2").style.counterReset = "egg";
setTextContent(stylesheets[1], "*:first-letter { }");
}
function setTextContent(n, t) { n.textContent = t; }
var stylesheets = [];
function initFuzzerSpecific()
{
var myStylesheetHolder = document.getElementsByTagName("head")[0];
for (var i = 0; i < 25; ++i) {
var s = document.createElementNS("http://www.w3.org/1999/xhtml", 'style');
s.style.display = "none";
myStylesheetHolder.appendChild(s);
stylesheets.push(s);
}
}
</script>
</head>
<body>
<p><q>Foo</q></p>
<p id="p2"><q id="q2">0</q></p>
<script>
document.body.offsetWidth;
boom1();
</script>
</body>
</html>
|
