summaryrefslogtreecommitdiffstats
path: root/layout/style/crashtests/1404316.html
diff options
context:
space:
mode:
Diffstat (limited to 'layout/style/crashtests/1404316.html')
-rw-r--r--layout/style/crashtests/1404316.html20
1 files changed, 20 insertions, 0 deletions
diff --git a/layout/style/crashtests/1404316.html b/layout/style/crashtests/1404316.html
new file mode 100644
index 0000000000..4ac2f16701
--- /dev/null
+++ b/layout/style/crashtests/1404316.html
@@ -0,0 +1,20 @@
+<html contenteditable="">
+ <style></style>
+ <script>
+ try { o1 = document.getSelection() } catch(e) { }
+ try { o2 = document.createElement('table') } catch(e) { }
+ try { o3 = document.createElement('r') } catch(e) { }
+ try { o4 = document.createElement('l') } catch(e) { }
+ try { o5 = document.createElement('k') } catch(e) { }
+ try { o6 = document.createElement('u') } catch(e) { }
+ try { document.documentElement.appendChild(o2) } catch(e) { }
+ try { document.documentElement.appendChild(o3) } catch(e) { }
+ try { document.documentElement.appendChild(o4) } catch(e) { }
+ try { document.documentElement.appendChild(o5) } catch(e) { }
+ try { document.designMode = "on"; } catch(e) { }
+ try { document.designMode = "off"; } catch(e) { }
+ try { o1.selectAllChildren(o2) } catch(e) { }
+ try { document.styleSheets[0].insertRule("e{", 0); } catch(e) { }
+ try { document.documentElement.appendChild(o6) } catch(e) { }
+ </script>
+</html> \ No newline at end of file