summaryrefslogtreecommitdiffstats
path: root/layout/xul/crashtests/432068-1.xul
diff options
context:
space:
mode:
Diffstat (limited to 'layout/xul/crashtests/432068-1.xul')
-rw-r--r--layout/xul/crashtests/432068-1.xul31
1 files changed, 31 insertions, 0 deletions
diff --git a/layout/xul/crashtests/432068-1.xul b/layout/xul/crashtests/432068-1.xul
new file mode 100644
index 000000000..02c3114e6
--- /dev/null
+++ b/layout/xul/crashtests/432068-1.xul
@@ -0,0 +1,31 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">
+
+<hbox style="display: none;">
+ <bindings xmlns="http://www.mozilla.org/xbl">
+ <binding id="x">
+ <content><listitem xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"/></content>
+ </binding>
+ </bindings>
+</hbox>
+
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("b").style.MozBinding = "url('#x')";
+
+ // Flush layout.
+ document.documentElement.boxObject.height;
+
+ document.getElementById("listbox").removeChild(document.getElementById("c"));
+}
+
+</script>
+
+<listbox id="listbox"><listitem/><listitem id="b"/><listitem id="c"/></listbox>
+
+</window>