tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

325024.html (595B)

      1 <html><head>
      2 <title>Testcase bug 325024 - Crash with evil testcase, using object, display: table-column, etc</title>
      3 </head>
      4 <body>
      5 <object>
      6 <div>Mozilla should not crash on this page</div>
      7 <span style="display: table-column;">
      8 <span style="display: block;"></span>
      9 </span><span style="display: table-cell;">
     10 </span>
     11 <isindex style="position: absolute; ">
     12 </object>
     13 
     14 <script>
     15 document.body.getElementsByTagName('*')[2].removeAttribute('style');
     16 document.body.offsetHeight;
     17 document.body.getElementsByTagName('*')[3].removeAttribute('style');
     18 document.body.offsetHeight;
     19 </script>
     20 </body></html>