dom/base/crashtests/841205.html
author Norisz Fay <nfay@mozilla.com>
Wed, 20 Oct 2021 12:24:14 +0300
changeset 596404 e45ba61007d1f8771179c0cc258166930acd75a5
parent 212358 2db29c0ae60b6eb0e196165631127d195fe2ef0b
permissions -rw-r--r--
Backed out 2 changesets (bug 1732674) for line iterator crashes (bug 1733047) a=backout Backed out changeset 730555699380 (bug 1732674) Backed out changeset f529288a6dde (bug 1732674)

<!DOCTYPE html>
<html>
<head>
<script>

function boom()
{
  var b = document.createElement('bdi');
  var c = document.createElement('div');
  var d = document.createElement('div');

  b.appendChild(c);
  c.appendChild(d);
  b.removeChild(c);
  d.appendChild(b);
  document.createElement('div').appendChild(c);
  b.appendChild(document.createElement('div'));

  b.setAttribute('dir', "auto");
}

</script>
</head>
<body onload="boom();"></body>
</html>