content/xbl/crashtests/336960-1-inner.xhtml
author Bob Clary <bclary@bclary.com>
Fri, 24 Apr 2009 10:08:12 -0700
changeset 27741 6ad02f8a56adcda3ae61978e48e875925fd9b534
permissions -rw-r--r--
bug 336960 - crash test by Martijn Wargers.

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
  <script>
    var x=document.createElementNS('http://www.w3.org/1999/xhtml','style');
    document.documentElement.appendChild(x);
    function doe(){
      var y=document.getElementsByTagName('style')[0];
    }
    setTimeout(doe,500);
  </script>

  <style>
  style {-moz-binding:url(#randomxbl);}
  </style>

  <bindings xmlns="http://www.mozilla.org/xbl">
    <binding id="randomxbl">
      <implementation>
        <constructor>
          var x= parent.document.getElementsByTagName('iframe')[0];
x.parentNode.removeChild(x);
        </constructor>
      </implementation>
    </binding>
  </bindings>
</head>
<body>
</body>
</html>