layout/generic/crashtests/350370.html
author Noemi Erli <nerli@mozilla.com>
Sat, 12 Jan 2019 00:00:06 +0200
changeset 453615 1ddef6cf6c7ee86191872cac0782b9f6dc01c923
parent 409521 0016368787a44bdf5deb4c9b73f3c0b59d2bc27a
child 491931 bb59a0c3716298bd4645885b530d501809715541
permissions -rw-r--r--
Merge mozilla-central to inbound. a=merge CLOSED TREE

<html><head>
<title>Testcase bug 350370 - Crash [@ ComputedStyle::FindChildWithRules] with ::first-line, appending rows and table-cells, etc</title>
<style>
#b td::first-line { font-size:110%;}
nobr::first-line { font-size:110%;}

#b td::after { content:"anonymous text"; }
nobr::after{ content:"anonymous text"; }

#b::before { content:"before text";}
#b td::before { content:"before text";}
</style>
</head>
<body>
<table style="display: table-row;"></table><nobr style="display: list-item; -moz-column-count: 2;">
<table id="b" style="display: inline;"></table>
</nobr>
<br>
This page should not crash Mozilla
<script>
function doe(){
   var td = document.createElement('td');;
   td.setAttribute('height', '50%');
   var tr = document.createElement('tr');;
   tr.setAttribute('height', '50%');
   tr.appendChild(td);
   document.getElementsByTagName('table')[1].appendChild(tr);
   document.body.offsetHeight;

   var td = document.createElement('td');;
   td.setAttribute('height', '50%');
   document.getElementsByTagName('tr')[0].appendChild(td); 
   document.body.offsetHeight;

   var td = document.createElement('td');;
   td.setAttribute('height', '50%');
   document.getElementsByTagName('tr')[0].appendChild(td); 
} 
setTimeout(doe, 60);
</script>
</body>
</html>