1.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000
1.2 +++ b/xpcom/string/crashtests/395651-1.html Wed Dec 31 06:09:35 2014 +0100
1.3 @@ -0,0 +1,31 @@
1.4 +<html>
1.5 +<head>
1.6 +<script>
1.7 +
1.8 +function X() { dump("X\n"); }
1.9 +function Y() { dump("Y\n"); }
1.10 +
1.11 +function boom()
1.12 +{
1.13 + dump("Start9\n");
1.14 +
1.15 + var div = document.getElementById("v");
1.16 +
1.17 + var textNode = document.createTextNode(String.fromCharCode(0xDAAF)); // high surrogate
1.18 + div.appendChild(textNode);
1.19 +
1.20 + document.addEventListener("DOMCharacterDataModified", X, true);
1.21 + textNode.data += 'B';
1.22 + document.removeEventListener("DOMCharacterDataModified", X, true);
1.23 +
1.24 + document.addEventListener("DOMAttrModified", Y, true);
1.25 + textNode.data += String.fromCharCode(0xDF53); // low surrogate
1.26 + document.removeEventListener("DOMAttrModified", Y, true);
1.27 +}
1.28 +
1.29 +</script>
1.30 +</head>
1.31 +
1.32 +<body onload="boom();"><div id="v"></div></body>
1.33 +
1.34 +</html>
