--- a/parser/htmlparser/tests/mochitest/Makefile.in
+++ b/parser/htmlparser/tests/mochitest/Makefile.in
@@ -52,15 +52,17 @@ include $(topsrcdir)/config/rules.mk
html5_tree_construction_exceptions.js \
test_html5_tree_construction.html \
test_bug174351.html \
test_bug339350.xhtml \
test_bug358797.html \
test_bug396568.html \
test_bug418464.html \
test_bug460437.xhtml \
+ test_bug502091.html \
+ bug_502091_iframe.html \
test_compatmode.html \
regressions.txt \
invalidchar.xml \
$(NULL)
libs:: $(_TEST_FILES)
$(INSTALL) $(foreach f,$^,"$f") $(DEPTH)/_tests/testing/mochitest/tests/$(relativesrcdir)
new file mode 100644
--- /dev/null
+++ b/parser/htmlparser/tests/mochitest/bug_502091_iframe.html
@@ -0,0 +1,17 @@
+<html>
+<head>
+<title>Crash [@ nsContentSink::ProcessHeaderData] with meta in innerHTML</title>
+</head>
+<body>
+<div id="testdiv">
+ testdiv
+ </div>
+<script>
+var x=document.createElement('div');
+x.innerHTML = '<meta http-equiv="Content-Type" content="text/html;"></meta>';
+document.getElementById("testdiv").appendChild(x);
+</script>
+some text here
+</body>
+</html>
+
new file mode 100644
--- /dev/null
+++ b/parser/htmlparser/tests/mochitest/test_bug502091.html
@@ -0,0 +1,49 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=502091
+
+Adding a <meta> element by writing to innerHTML should work correctly.
+-->
+<head>
+ <title>Test for Bug 502091</title>
+ <script type="text/javascript" src="/MochiKit/packed.js"></script>
+ <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+ <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=502091">Mozilla Bug 502091</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<div id="test">
+<script class="testbody" type="text/javascript">
+ function $(id) { return document.getElementById(id); }
+
+ netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
+ var prefs = Components.classes["@mozilla.org/preferences-service;1"]
+ .getService(Components.interfaces.nsIPrefBranch);
+ var gOriginalHtml5Pref = prefs.getBoolPref("html5.enable");
+ prefs.setBoolPref("html5.enable", true);
+
+ var iframe=document.createElement("iframe");
+ iframe.setAttribute("id", "iframe");
+ iframe.src = "bug_502091_iframe.html";
+ iframe.onload = function () {
+ var div = $("iframe").contentDocument.getElementById("testdiv");
+ var meta = div.getElementsByTagName("meta");
+ is(meta.length, 1, "meta element not added to div");
+
+ netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
+ var prefs = Components.classes["@mozilla.org/preferences-service;1"]
+ .getService(Components.interfaces.nsIPrefBranch);
+ prefs.setBoolPref("html5.enable", gOriginalHtml5Pref);
+ };
+ $("test").appendChild(iframe);
+
+</script>
+</div>
+</body>
+</html>
+