Blame layout/generic/crashtests/457380-1.html

Packit f0b94e

Packit f0b94e
<html>
Packit f0b94e
<head>
Packit f0b94e

Packit f0b94e
<script type="text/javascript">
Packit f0b94e

Packit f0b94e
function boom()
Packit f0b94e
{
Packit f0b94e
  document.documentElement.style.MozColumnCount = '3';
Packit f0b94e
  document.documentElement.offsetHeight;
Packit f0b94e
  document.documentElement.style.MozColumnCount = '';
Packit f0b94e
}
Packit f0b94e

Packit f0b94e
</script>
Packit f0b94e

Packit f0b94e
<style type="text/css">
Packit f0b94e

Packit f0b94e
html:before { content: '0'; }
Packit f0b94e

Packit f0b94e
</style>
Packit f0b94e

Packit f0b94e
</head>
Packit f0b94e

Packit f0b94e
<frameset onload="boom();"></frameset>
Packit f0b94e

Packit f0b94e
</html>