dom/base/crashtests/439206-1.html

changeset 0
6474c204b198
equal deleted inserted replaced
-1:000000000000 0:56e77510ca1e
1 <!DOCTYPE html>
2 <html>
3 <head>
4 <script type="text/javascript">
5
6 function boom()
7 {
8 var s = document.createElement("STYLE");
9 var t = document.createTextNode("\uDB00x"); // a high surrogate followed by 'x'
10 document.documentElement.appendChild(s);
11 s.appendChild(t);
12 }
13
14 </script>
15 </head>
16
17 <body onload="boom();">
18 </body>
19 </html>

mercurial