Bug 424629 - Crash test.
authorJesse Ruderman <jruderman@gmail.com>
Sat, 23 Feb 2013 11:38:14 +0100
changeset 122749 4cee281ad01159a87d145bb19d671f81fc9661c3
parent 122748 999622231e133a398b2fe067cdb2e3e13503eabb
child 122750 cc398711f18706b038958577b3b36e25826439cd
push id23469
push usermpalmgren@mozilla.com
push dateSat, 23 Feb 2013 10:38:20 +0000
treeherdermozilla-inbound@ffb9e097d950 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs424629
milestone22.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 424629 - Crash test.
layout/generic/crashtests/424629.html
layout/generic/crashtests/crashtests.list
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/424629.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("o").appendChild(document.createTextNode('d'));
+  document.body.offsetHeight;
+  document.getElementById("b").firstChild.data = "\u202E";
+  document.getElementById("a").firstChild.data = "ZZZZZZZ";
+}
+
+</script>
+</head>
+
+<body onload="boom();" style="font-family: monospace; width: 8ch;">
+
+<div><span id="o"><span id="a">a</span><span id="b">b&#x202E;</span><span> c </span></span></div>
+
+</body>
+</html>
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -233,16 +233,17 @@ load 418932-1.html
 load 420000-1.html
 load 420785-1.xhtml
 load 421404-1.html
 asserts(0-2) load 421671.html # Bug 481035
 load 422283-1.html
 load 422301-1.html
 load 423055-1.html
 load 423264-1.html
+load 424629.html
 load 425253-1.html
 load 426040-1.html
 load 426272-1.html
 load 428263-1.html
 load 429969-1.html
 load 429981-1.html
 load 430332-1.html
 load 430344-1.html