summaryrefslogtreecommitdiffstats
path: root/parser/htmlparser/tests/mochitest/bug_502091_iframe.html
diff options
context:
space:
mode:
Diffstat (limited to 'parser/htmlparser/tests/mochitest/bug_502091_iframe.html')
-rw-r--r--parser/htmlparser/tests/mochitest/bug_502091_iframe.html17
1 files changed, 17 insertions, 0 deletions
diff --git a/parser/htmlparser/tests/mochitest/bug_502091_iframe.html b/parser/htmlparser/tests/mochitest/bug_502091_iframe.html
new file mode 100644
index 0000000000..076d3ed662
--- /dev/null
+++ b/parser/htmlparser/tests/mochitest/bug_502091_iframe.html
@@ -0,0 +1,17 @@
+<html>
+<head>
+<title>Crash [@ nsContentSink::ProcessHeaderData] with meta in innerHTML</title>
+</head>
+<body>
+<div id="testdiv">
+ testdiv
+ </div>
+<script>
+var x = document.createElement("div");
+x.innerHTML = '<meta http-equiv="Content-Type" content="text/html;"></meta>';
+document.getElementById("testdiv").appendChild(x);
+</script>
+some text here
+</body>
+</html>
+