summaryrefslogtreecommitdiffstats
path: root/layout/generic/crashtests/868906.html
diff options
context:
space:
mode:
Diffstat (limited to 'layout/generic/crashtests/868906.html')
-rw-r--r--layout/generic/crashtests/868906.html54
1 files changed, 54 insertions, 0 deletions
diff --git a/layout/generic/crashtests/868906.html b/layout/generic/crashtests/868906.html
new file mode 100644
index 0000000000..24d3bfa3e8
--- /dev/null
+++ b/layout/generic/crashtests/868906.html
@@ -0,0 +1,54 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+ var root = document.documentElement;
+ while(root.firstChild) { root.firstChild.remove(); }
+ root.appendChild(document.createElement("body"));
+ root.offsetHeight;
+
+ var bigText = document.createTextNode("");
+ bigText.data += "\u202D";
+ bigText.data += "A";
+ bigText.data += "\x1C";
+ bigText.data += "\u062A";
+ bigText.data += "E";
+ bigText.data += "\u062E";
+ bigText.data += " ";
+ bigText.data += "\u202D";
+ bigText.data += "X";
+ bigText.data += "\x1C";
+ bigText.data += "Y";
+ root.appendChild(bigText);
+
+ var smallText = document.createTextNode("Z");
+ root.appendChild(smallText);
+
+ root.focus();
+
+ function del()
+ {
+ var range = document.createRange();
+ range.setStart(root, 0);
+ range.setEnd(bigText, bigText.data.length);
+ range.deleteContents();
+ }
+
+ del();
+
+ function finish() {
+ document.documentElement.removeAttribute('class');
+ }
+
+ setTimeout(finish, 0);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>