diff options
Diffstat (limited to 'layout/generic/crashtests/424629.html')
| -rw-r--r-- | layout/generic/crashtests/424629.html | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/layout/generic/crashtests/424629.html b/layout/generic/crashtests/424629.html new file mode 100644 index 000000000..d142897ce --- /dev/null +++ b/layout/generic/crashtests/424629.html @@ -0,0 +1,21 @@ +<html> +<head> +<script type="text/javascript"> + +function boom() +{ + document.getElementById("o").appendChild(document.createTextNode('d')); + document.body.offsetHeight; + document.getElementById("b").firstChild.data = "\u202E"; + document.getElementById("a").firstChild.data = "ZZZZZZZ"; +} + +</script> +</head> + +<body onload="boom();" style="font-family: monospace; width: 8ch;"> + +<div><span id="o"><span id="a">a</span><span id="b">b‮</span><span> c </span></span></div> + +</body> +</html> |