summaryrefslogtreecommitdiffstats
path: root/dom/base/crashtests/831287.html
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--dom/base/crashtests/831287.html11
1 files changed, 11 insertions, 0 deletions
diff --git a/dom/base/crashtests/831287.html b/dom/base/crashtests/831287.html
new file mode 100644
index 0000000000..3fc841cc9b
--- /dev/null
+++ b/dom/base/crashtests/831287.html
@@ -0,0 +1,11 @@
+<head dir=auto id=test1><body id=test2><div" id=test3 itemtype=http://example.com/bar style="speak-numeral:> "><canvas id=c><p id=test4>FAIL (fallback content)</p></canvas>
+
+><script>
+document.addEventListener("DOMContentLoaded", CFcrash);
+function CFcrash() {
+test1.appendChild(test4);
+test1.setAttribute("dir", "foopy");
+test1.appendChild(c);
+test4.textContent = test2.outerHTML;
+c.appendChild(test3);
+}</script>> \ No newline at end of file