tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

dirty-rowgroup-crash.html (422B)

      1 <!DOCTYPE html>
      2 <div style='container-type: size;'></div>
      3 <table>
      4  <tbody id='id_0'></tbody>
      5    <th id='id_1'>
      6      <tr>
      7        <th></th>
      8      </tr>
      9    </th>
     10 </table>
     11 <script>
     12  const tbody = document.getElementById('id_0')
     13  tbody.getBoundingClientRect();
     14  const theader = document.getElementById('id_1')
     15  tbody.outerText = 'foo';
     16  theader.setAttribute('rowspan', 100)
     17  tbody.getBoundingClientRect();
     18 </script>