content/events/crashtests/422009-1.xhtml
author David Anderson <danderson@mozilla.com>
Wed, 05 Oct 2011 18:37:11 -0700
changeset 112094 cad26d2fb5af799dfe030fd2a8948d617eac2f52
parent 13343 aa2a6d65e3f51af708710bb581e36b281e0deff0
permissions -rw-r--r--
Backout merge.

<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<bindings xmlns="http://www.mozilla.org/xbl">
  <binding id="g">
    <implementation>
      <constructor>
        throw 3;
      </constructor>
    </implementation>
  </binding>
</bindings>

<script type="text/javascript">

function boom()
{
  var HTML_NS = "http://www.w3.org/1999/xhtml";
  var span = document.createElementNS(HTML_NS, 'span');
  span.style.MozBinding = "url(#g)";
  document.removeChild(document.documentElement)
  var w = document.createElementNS(HTML_NS, 'body');
  w.setAttribute('onload', "/");
  document.appendChild(span);
}

</script>
</head>

<body onload="boom();"></body>
</html>