Thu, 22 Jan 2015 13:21:57 +0100
Incorporate requested changes from Mozilla in review: https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6
1 ><bdi id=test1><refa id=test2>嵐>></bdi>><h1 id=test3><script>
2 document.addEventListener("DOMContentLoaded", CFcrash, false);
3 function CFcrash() {
4 test1.setAttribute("dir", "invalid");
5 test2.textContent = " S ";
6 test3.appendChild(test1);
7 }</script>