322678.html (841B)
1 <!-- Quirks mode on purpose --> 2 <html> 3 <head> 4 <title>Testcase bug 322678 - Crash [@ nsIFrame::GetParent] with evil testcase position:relative/absolute/display:table-column, etc</title> 5 <script> 6 function run(){ 7 document.body.offsetHeight; 8 document.getElementById('one').removeAttribute('style'); 9 document.body.offsetHeight; 10 document.getElementById('two').removeAttribute('style'); 11 document.body.offsetHeight; 12 } 13 </script> 14 </head> 15 <body onload="run();"> 16 <span> 17 <div style="position: relative;"> 18 <span style="position: absolute;"></span> 19 </div> 20 21 <span id="one" style="display: table-column;"> 22 <span id="two" style="display: block; position: relative;"> 23 </span> 24 </span><u style="display: table-cell;"> </u> 25 </span> 26 </body> 27 </html>