summaryrefslogtreecommitdiffstats
path: root/dom/html/crashtests/590387.html
blob: 50cd05ac9eda3452d6c3c96c4d4638c5da8c8664 (plain)
1
2
3
4
5
6
7
8
<!DOCTYPE html>
<html>
<head>
<script>
document.createElement("div").innerHTML = "<output form=x>";
</script>
</head>
</html>