layout/generic/crashtests/424629.html


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

<html>
<head>
<script type="text/javascript">

function boom()
{
  document.getElementById("o").appendChild(document.createTextNode('d'));
  document.body.offsetHeight;
  document.getElementById("b").firstChild.data = "\u202E";
  document.getElementById("a").firstChild.data = "ZZZZZZZ";
}

</script>
</head>

<body onload="boom();" style="font-family: monospace; width: 8ch;">

<div><span id="o"><span id="a">a</span><span id="b">b&#x202E;</span><span> c </span></span></div>

</body>
</html>