398682-1.html - mozsearch

Enable keyboard shortcuts

<!DOCTYPE html>

<html>

<head>

<script>

function boom()

  // Only this exact number of calls to bounce() triggers the bug,

  // but changing the depth of the document changes the number of

  // bounce() calls needed.  For example, removing the 'p' tag

  // makes it so one additional bounce() is needed.

  for (var i = 0; i < 7; ++i)

    bounce();

  var tr = document.getElementById("tr");

  tr.style.display = "none";

  document.documentElement.offsetHeight;

  bounce();

  document.documentElement.offsetHeight;

  tr.style.display = "";

  document.documentElement.offsetHeight;

  var td = document.getElementById("td");

  td.style.display = "none";

  document.documentElement.offsetHeight;

  bounce();

  document.documentElement.offsetHeight;

  td.style.display = "";

function bounce()

    var docElem = document.documentElement;

    var docElemChildren = [];

    while (docElem.firstChild) {

        docElemChildren.push(docElem.firstChild);

        docElem.firstChild.remove();

    for (var i = 0; i < docElemChildren.length; ++i)

        docElem.appendChild(docElemChildren[i]);

</script>

<style type="text/css">

#a { color: orange; }

#b { color: blue; }

</style>

</head>

<body onload="boom();">

  <table border="10"><tr id="tr"><td id="td">

    <p><span id="a">a</span><span id="b">b</span></p>

  </td></tr></table>

</body>

</html>