blob: fd818476ecf2d6a4994055e0b36a97468cd9fe8d (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
|
<html>
<head>
<title> Bug 456041 - Crash [@ nsCellMapColumnIterator::GetNextFrame] with contenteditable, generated content on table and double tbody</title>
<script>
//setTimeout(function() {window.location.reload();}, 500);
</script>
</head>
<body>
<span contenteditable="true"></span>
<style id="e">body table::after { content:"b";}</style>
<table>
<script>document.body.offsetHeight;</script>
<tbody></tbody>
<tbody></tbody>
</table>
</body>
</html>
|
