398682-1.html (1364B)
1 <!DOCTYPE html> 2 <html> 3 <head> 4 <script> 5 6 function boom() 7 { 8 // Only this exact number of calls to bounce() triggers the bug, 9 // but changing the depth of the document changes the number of 10 // bounce() calls needed. For example, removing the 'p' tag 11 // makes it so one additional bounce() is needed. 12 13 for (var i = 0; i < 7; ++i) 14 bounce(); 15 16 var tr = document.getElementById("tr"); 17 tr.style.display = "none"; 18 document.documentElement.offsetHeight; 19 bounce(); 20 document.documentElement.offsetHeight; 21 tr.style.display = ""; 22 23 document.documentElement.offsetHeight; 24 25 var td = document.getElementById("td"); 26 td.style.display = "none"; 27 document.documentElement.offsetHeight; 28 bounce(); 29 document.documentElement.offsetHeight; 30 td.style.display = ""; 31 } 32 33 34 function bounce() 35 { 36 var docElem = document.documentElement; 37 var docElemChildren = []; 38 while (docElem.firstChild) { 39 docElemChildren.push(docElem.firstChild); 40 docElem.firstChild.remove(); 41 } 42 43 for (var i = 0; i < docElemChildren.length; ++i) 44 docElem.appendChild(docElemChildren[i]); 45 } 46 47 </script> 48 49 <style type="text/css"> 50 #a { color: orange; } 51 #b { color: blue; } 52 </style> 53 54 </head> 55 56 <body onload="boom();"> 57 <table border="10"><tr id="tr"><td id="td"> 58 <p><span id="a">a</span><span id="b">b</span></p> 59 </td></tr></table> 60 </body> 61 62 </html>