bug 348126 - crash test by Martijn Wargers.

This commit is contained in:
Bob Clary 2009-04-24 10:08:15 -07:00
parent 8929eb90cd
commit 216ea9541c
4 changed files with 38 additions and 0 deletions

View File

@ -0,0 +1,28 @@
<html><head><title>Testcase bug 348126 - Crash [@ nsImageFrame::SourceRectToDest] on reload and removing table-caption styles</title>
<script>
function removestyles(i){
document.getElementsByTagName('table')[0].removeAttribute('style');
document.getElementsByTagName('object')[0].removeAttribute('style');
document.getElementsByTagName('table')[1].removeAttribute('style');
document.location.reload();
}
setTimeout(removestyles,500,0);
</script>
</head><body>
Mozilla should not crash on reload on this page<br>
<object><table style="display: table-caption;">
<tbody><tr><td></td></tr></tbody>
</table><object style="display: table-caption;">
</object><table style="display: table-row-group;">
<tbody><tr><td>
<img src="348126-1.gif">
</td></tr></tbody></table>
<img src="348126-1.gif">
</object>
</body></html>

Binary file not shown.

After

Width:  |  Height:  |  Size: 980 B

View File

@ -0,0 +1,9 @@
<html class="reftest-wait">
<head>
<script>
setTimeout('document.documentElement.className = ""', 1000);
</script>
<body>
<iframe src="348126-1-inner.html"></iframe>
</body>
</html>

View File

@ -99,6 +99,7 @@ load 344300-1.html
load 344300-2.html
load 344340-1.xul
load 347898-1.html
load 348126-1.html
load 348688-1.html
load 348708-1.xhtml
load 349095-1.xhtml