Blame layout/generic/crashtests/350370.html

Packit f0b94e
<html><head>
Packit f0b94e
<title>Testcase bug 350370 - Crash [@ nsStyleContext::FindChildWithRules] with ::first-line, appending rows and table-cells, etc</title>
Packit f0b94e
<style>
Packit f0b94e
#b td::first-line { font-size:110%;}
Packit f0b94e
nobr::first-line { font-size:110%;}
Packit f0b94e

Packit f0b94e
#b td::after { content:"anonymous text"; }
Packit f0b94e
nobr::after{ content:"anonymous text"; }
Packit f0b94e

Packit f0b94e
#b::before { content:"before text";}
Packit f0b94e
#b td::before { content:"before text";}
Packit f0b94e
</style>
Packit f0b94e
</head>
Packit f0b94e
<body>
Packit f0b94e
<nobr style="display: list-item; -moz-column-count: 2;">
Packit f0b94e
Packit f0b94e
</nobr>
Packit f0b94e

Packit f0b94e
This page should not crash Mozilla
Packit f0b94e
<script>
Packit f0b94e
function doe(){
Packit f0b94e
   var td = document.createElement('td');;
Packit f0b94e
   td.setAttribute('height', '50%');
Packit f0b94e
   var tr = document.createElement('tr');;
Packit f0b94e
   tr.setAttribute('height', '50%');
Packit f0b94e
   tr.appendChild(td);
Packit f0b94e
   document.getElementsByTagName('table')[1].appendChild(tr);
Packit f0b94e
   document.body.offsetHeight;
Packit f0b94e

Packit f0b94e
   var td = document.createElement('td');;
Packit f0b94e
   td.setAttribute('height', '50%');
Packit f0b94e
   document.getElementsByTagName('tr')[0].appendChild(td); 
Packit f0b94e
   document.body.offsetHeight;
Packit f0b94e

Packit f0b94e
   var td = document.createElement('td');;
Packit f0b94e
   td.setAttribute('height', '50%');
Packit f0b94e
   document.getElementsByTagName('tr')[0].appendChild(td); 
Packit f0b94e
} 
Packit f0b94e
setTimeout(doe, 60);
Packit f0b94e
</script>
Packit f0b94e
</body>
Packit f0b94e
</html>