layout/generic/crashtests/762764-1.html
author Noemi Erli <nerli@mozilla.com>
Sat, 12 Jan 2019 00:00:06 +0200
changeset 453615 1ddef6cf6c7ee86191872cac0782b9f6dc01c923
parent 97104 96303b557d55c086b129e43f4be08030f447808d
permissions -rw-r--r--
Merge mozilla-central to inbound. a=merge CLOSED TREE

<!DOCTYPE html>
<script>

function boom()
{
  document.documentElement.removeChild(document.body);
  var newBody = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
  document.documentElement.appendChild(newBody);
  newBody.contentEditable = "true";
  document.execCommand("inserthtml", false, "<textarea>a</textarea>");
  document.execCommand("insertimage", false, "1.jpg");
  try { document.execCommand("forwardDelete", false, null); } catch(e) { }
  document.execCommand("inserthtml", false, "x<span><\/span>y");
}

</script>

<body onload="boom();"></body>