dom/html/crashtests/1440523.html
author Hiroyuki Ikezoe <hikezoe@mozilla.com>
Mon, 26 Mar 2018 11:25:56 +0900
changeset 772410 dcefd078c05ed91b613605c2d2ec2d52dad7a885
permissions -rw-r--r--
Bug 1440523 - Bail out from nsHTMLDocument::EditingStateChanged if the docshell is being destroyed by FlushPendingNotifications call. r?masayuki MozReview-Commit-ID: DlFXWdpB1Xv

<html>
  <head>
    <script>
      try { frame = document.createElement('frame') } catch(e) { }
      try { document.documentElement.appendChild(frame) } catch(e) { }
      try { contentDocument = frame.contentDocument } catch(e) { }
      try { contentDocument.writeln("<p contenteditable='true'>") } catch(e) { }
      try { anotherDocument = document.implementation.createHTMLDocument(); } catch(e) { }
      try { rootOfAnotherDocument = anotherDocument.documentElement; } catch(e) { }
      try { document.replaceChild(rootOfAnotherDocument, document.documentElement); } catch(e) { }
   </script>
  </head>
</html>