widget/cocoa/crashtests/464589-1.html


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

<html>
<head>
<script type="text/javascript">

function boom()
{
  var o2 = document.createElement("option");
  document.getElementById("o1").appendChild(o2);
  o2.style.padding = "131072cm";
}

</script>
</head>

<body onload="boom();">

<select><option id="o1" style="height: 0cm;"></option></select>

</body>
</html>