summaryrefslogtreecommitdiffstats
path: root/dom/html/crashtests/453406-1.html
diff options
context:
space:
mode:
Diffstat (limited to 'dom/html/crashtests/453406-1.html')
-rw-r--r--dom/html/crashtests/453406-1.html34
1 files changed, 34 insertions, 0 deletions
diff --git a/dom/html/crashtests/453406-1.html b/dom/html/crashtests/453406-1.html
new file mode 100644
index 0000000000..bf75686553
--- /dev/null
+++ b/dom/html/crashtests/453406-1.html
@@ -0,0 +1,34 @@
+<html>
+<head>
+<script type="text/javascript">
+function boom()
+{
+ var r = document.documentElement;
+ while (r.firstChild)
+ r.firstChild.remove();
+
+ var b = document.createElement("BODY");
+ var s = document.createElement("SCRIPT");
+ var f1 = document.createElement("FORM");
+ var i = document.createElement("INPUT");
+ var br = document.createElement("BR");
+ var f2 = document.createElement("FORM");
+ var span = document.createElement("SPAN");
+ f1.appendChild(i);
+ f1.appendChild(br);
+ s.appendChild(f1);
+ b.appendChild(s);
+ f2.appendChild(span);
+ b.appendChild(f2)
+ document.documentElement.appendChild(b);
+ b.contentEditable = "true";
+ document.execCommand("indent", false, null);
+ b.contentEditable = "false";
+ span.appendChild(i);
+ i.remove();
+}
+</script>
+</head>
+<body onload="boom();">
+</body>
+</html>