editor/libeditor/crashtests/580151-1.xhtml
author Csoregi Natalia <ncsoregi@mozilla.com>
Sat, 01 Oct 2022 04:22:22 +0300
changeset 636750 5144d608cc2f43bf6b35742773ef0c7d2579ec27
parent 200232 8f48ab6499cfa2f071d8bb3c550884e94dbc7803
permissions -rw-r--r--
Backed out changeset 63fbc22d2223 (bug 1792741) for causing assertion failures on nsCSSFrameConstructor.cpp. CLOSED TREE

<!DOCTYPE html>
<html>
<head>
<script>

var t;

function boom()
{
  var b = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
  t = document.createElementNS("http://www.w3.org/1999/xhtml", "textarea");
  b.appendChild(t);
  document.removeChild(document.documentElement)
  document.appendChild(b)
  document.removeChild(document.documentElement)
  var ns = document.createElementNS("http://www.w3.org/1999/xhtml", "script");
  var nt = document.createTextNode("t.appendChild(document.createTextNode(' '));");
  ns.appendChild(nt);
  b.appendChild(ns);
  document.appendChild(b);
}

</script>
</head>
<body onload="boom();"></body>
</html>