tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

322678.html (841B)


      1 <!-- Quirks mode on purpose -->
      2 <html>
      3  <head>
      4    <title>Testcase bug 322678 - Crash [@ nsIFrame::GetParent] with evil testcase position:relative/absolute/display:table-column, etc</title>
      5    <script>
      6    function run(){
      7      document.body.offsetHeight;
      8      document.getElementById('one').removeAttribute('style');
      9      document.body.offsetHeight;
     10      document.getElementById('two').removeAttribute('style');
     11      document.body.offsetHeight;
     12    }
     13    </script>
     14  </head>
     15  <body onload="run();">
     16    <span>
     17      <div style="position: relative;">
     18        <span style="position: absolute;"></span>
     19      </div>
     20 
     21      <span id="one" style="display: table-column;">
     22        <span id="two" style="display: block; position: relative;">
     23        </span>
     24      </span><u style="display: table-cell;">  </u>
     25    </span>
     26  </body>
     27 </html>