32 lines
783 B
HTML
32 lines
783 B
HTML
<html>
|
|
<p>This test must not crash.</p>
|
|
<script>
|
|
if (window.testRunner)
|
|
testRunner.dumpAsText();
|
|
|
|
function f1() {
|
|
document.write('<form>'); //Here we need the form tag to trigger the bug
|
|
document.getElementsByTagName("s")[0].innerHTML = 'foo';
|
|
}
|
|
|
|
function f2() {
|
|
try {
|
|
document.getElementsByTagName("kbd")[0].innerHTML = 'foo';
|
|
document.getElementsByTagName("kbd")[0].insertBefore(document.createElement('foo'),document.createElement('foo'));
|
|
} catch (e) {
|
|
// We are not interested in exceptions.
|
|
}
|
|
}
|
|
</script>
|
|
<s>
|
|
<!-- The following weird mark-up is needed to reproduce the crash -->
|
|
<script>f1();</script>
|
|
<xmp><mark>
|
|
<script>f1();</script>
|
|
<xmp></xmp>
|
|
<kbd>
|
|
<script>f2();</script>
|
|
</kbd>
|
|
</s>
|
|
</html>
|