comparison: parser/htmlparser/tests/crashtests/502869-iframe.html
parser/htmlparser/tests/crashtests/502869-iframe.html
- changeset 0
- 6474c204b198
equal
deleted
inserted
replaced
|
1 <html><head><title>[HTML5] Crash [@ nsHtml5TreeBuilder::appendToCurrentNodeAndPushElementMayFoster] with document.write and removing stuff</title></head><body><a> |
|
2 <script> |
|
3 var x=document.getElementsByTagName("*"); |
|
4 x[1].parentNode.removeChild(x[1]); |
|
5 x[2].parentNode.removeChild(x[2]); |
|
6 </script> |
|
7 <div> |
|
8 <script>document.write('<'+'script>document.removeChild(document.documentElement);<'+'/script>');</script> |
|
9 </a></body></html> |