summaryrefslogtreecommitdiffstats
path: root/dom/base/crashtests/476526.html
diff options
context:
space:
mode:
Diffstat (limited to 'dom/base/crashtests/476526.html')
-rw-r--r--dom/base/crashtests/476526.html10
1 files changed, 10 insertions, 0 deletions
diff --git a/dom/base/crashtests/476526.html b/dom/base/crashtests/476526.html
new file mode 100644
index 0000000000..b3d8f8e1c8
--- /dev/null
+++ b/dom/base/crashtests/476526.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML>
+<html>
+<body>
+<iframe src="data:text/xml,
+ <html xmlns='http://www.w3.org/1999/xhtml'
+ onDOMAttrModified='window.frameElement.parentNode.removeChild(window.frameElement)'>
+ </html>"
+ onload="event.target.contentDocument.documentElement.setAttribute('x', 'y');"></iframe>
+</body>
+</html>