Blame layout/generic/crashtests/534366-2.html

Packit f0b94e
<html>
Packit f0b94e
<head>
Packit f0b94e
<style type="text/css">
Packit f0b94e
Packit f0b94e
body { font-family: monospace; width: 4ch; }
Packit f0b94e
body::first-line { }
Packit f0b94e
body *::before { content: 'w';}
Packit f0b94e
Packit f0b94e
</style>
Packit f0b94e
Packit f0b94e
<script type="text/javascript">
Packit f0b94e
Packit f0b94e
function boom()
Packit f0b94e
{
Packit f0b94e
  var de = document.documentElement;
Packit f0b94e
  var body = document.body;
Packit f0b94e
Packit f0b94e
  var span = document.createElementNS("http://www.w3.org/1999/xhtml", "span");
Packit f0b94e
  var r1 = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mrow");
Packit f0b94e
  var mmm = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mmultiscripts");
Packit f0b94e
Packit f0b94e
  body.appendChild(span);
Packit f0b94e
  r1.appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", "mrow"));
Packit f0b94e
  body.appendChild(r1);
Packit f0b94e
  body.appendChild(mmm);
Packit f0b94e
  de.offsetHeight;
Packit f0b94e
  r1.appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", 'mrow'));
Packit f0b94e
  de.offsetHeight;
Packit f0b94e
  mmm.appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", 'mrow'));
Packit f0b94e
  de.offsetHeight;
Packit f0b94e
  
Packit f0b94e
  document.removeChild(de);
Packit f0b94e
  document.appendChild(de);
Packit f0b94e
  de.offsetHeight;
Packit f0b94e
}
Packit f0b94e
Packit f0b94e
window.addEventListener("load", boom);
Packit f0b94e
Packit f0b94e
</script>
Packit f0b94e
</head>
Packit f0b94e
<body></body>
Packit f0b94e
</html>