Source code

Revision control

Copy as Markdown

Other Tools

Test Info:

<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>Firefox bug 2064785 - ruby ::before whitespace-flag re-entry UAF</title>
<style>
#p::before { display: ruby; content: "a"; }
#p.swap::before { content: " "; }
</style>
</head>
<body>
<div id="p"></div>
<script>
const p = document.getElementById('p');
// Flush initial layout with ::before ruby content "a"
document.body.offsetHeight;
// Add class so that ::before content becomes " "
p.classList.add('swap');
// Force reflow with the generated content that is now whitespace-only
document.body.offsetHeight;
</script>
</body>
</html>