File: contain-size-layout-abspos-flex-container-crash.html

package info (click to toggle)
thunderbird 1%3A128.14.0esr-1~deb12u1
  • links: PTS, VCS
  • area: main
  • in suites: bookworm
  • size: 4,334,824 kB
  • sloc: cpp: 7,391,917; javascript: 5,617,271; ansic: 3,833,216; python: 1,230,742; xml: 619,690; asm: 456,022; java: 179,892; sh: 118,796; makefile: 21,908; perl: 14,825; objc: 12,399; yacc: 4,583; pascal: 2,973; lex: 1,720; ruby: 1,190; exp: 762; sql: 674; awk: 580; php: 436; lisp: 430; sed: 70; csh: 10
file content (37 lines) | stat: -rw-r--r-- 894 bytes parent folder | download | duplicates (20) 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
 
<!DOCTYPE html>
<html>
  <meta charset="UTF-8">
  <link rel="author" title="Ting-Yu Lin" href="mailto:tlin@mozilla.com">
  <link rel="author" title="Mozilla" href="https://www.mozilla.org/">
  <link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1678469">
  <meta name="assert" content="This test ensures that the browser does not crash after removing the element 'c'.">

  <style>
  html { columns: 0 }
  body {
    transform: rotate(14deg);
  }
  #flex-container {
    display: flex;
    contain: size layout;
    position: absolute;
    width: 100px;
    height: 100px;
  }
  </style>

  <script>
  function boom() {
    let flex = document.getElementById('flex-container');
    let c = document.getElementById('c');
    flex.removeChild(c);
  }
  </script>

  <body onload="boom()">
    <div id="flex-container">
      x
      <div id="c"></div>
    </div>
  </body>
</html>