File: contain-size-layout-abspos-flex-container-crash.html

package info (click to toggle)
thunderbird 1%3A91.12.0-1~deb10u1
  • links: PTS, VCS
  • area: main
  • in suites: buster
  • size: 3,008,300 kB
  • sloc: cpp: 6,084,052; javascript: 4,790,441; ansic: 3,341,486; python: 862,958; asm: 366,542; xml: 204,277; java: 152,477; sh: 111,376; makefile: 21,388; perl: 15,312; yacc: 4,583; objc: 3,026; lex: 1,720; exp: 762; pascal: 635; awk: 564; sql: 453; php: 436; lisp: 432; ruby: 99; sed: 69; csh: 45
file content (37 lines) | stat: -rw-r--r-- 894 bytes parent folder | download | duplicates (19) 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
 
<!DOCTYPE html>
<html>
  <meta charset="UTF-8">
  <link rel="author" title="Ting-Yu Lin" href="mailto:tlin@mozilla.com">
  <link rel="author" title="Mozilla" href="https://www.mozilla.org/">
  <link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1678469">
  <meta name="assert" content="This test ensures that the browser does not crash after removing the element 'c'.">

  <style>
  html { columns: 0 }
  body {
    transform: rotate(14deg);
  }
  #flex-container {
    display: flex;
    contain: size layout;
    position: absolute;
    width: 100px;
    height: 100px;
  }
  </style>

  <script>
  function boom() {
    let flex = document.getElementById('flex-container');
    let c = document.getElementById('c');
    flex.removeChild(c);
  }
  </script>

  <body onload="boom()">
    <div id="flex-container">
      x
      <div id="c"></div>
    </div>
  </body>
</html>