summaryrefslogtreecommitdiffstats
path: root/dom/html/crashtests/1350972.html
diff options
context:
space:
mode:
authorNew Tobin Paradigm <email@mattatobin.com>2018-04-13 15:43:09 -0400
committerGitHub <noreply@github.com>2018-04-13 15:43:09 -0400
commit501db456d4d84a9345374e9b15775f6e10883a41 (patch)
tree279b8777ec467e25e157eed36d1ff30514ec9c17 /dom/html/crashtests/1350972.html
parent356c948bbde4271d17692abac0422e0eb5e609ed (diff)
parent84e449502f51e192d337eb793946d5b03f4c6460 (diff)
downloadUXP-501db456d4d84a9345374e9b15775f6e10883a41.tar
UXP-501db456d4d84a9345374e9b15775f6e10883a41.tar.gz
UXP-501db456d4d84a9345374e9b15775f6e10883a41.tar.lz
UXP-501db456d4d84a9345374e9b15775f6e10883a41.tar.xz
UXP-501db456d4d84a9345374e9b15775f6e10883a41.zip
Merge pull request #151 from janekptacijarabaci/js_dom_selection_crash_1
moebius#76: JS - DOM - Selection API - crashes
Diffstat (limited to 'dom/html/crashtests/1350972.html')
-rw-r--r--dom/html/crashtests/1350972.html22
1 files changed, 22 insertions, 0 deletions
diff --git a/dom/html/crashtests/1350972.html b/dom/html/crashtests/1350972.html
new file mode 100644
index 000000000..7af7f9e17
--- /dev/null
+++ b/dom/html/crashtests/1350972.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+ try { o1 = document.createElement('tr'); } catch(e) {};
+ try { o2 = document.createElement('div'); } catch(e) {};
+ try { o3 = document.createElement('hr'); } catch(e) {};
+ try { o4 = document.createElement('textarea'); } catch(e) {};
+ try { o5 = document.getSelection(); } catch(e) {};
+ try { o6 = document.createRange(); } catch(e) {};
+ try { document.documentElement.appendChild(o2); } catch(e) {};
+ try { document.documentElement.appendChild(o3); } catch(e) {};
+ try { o2.appendChild(o4); } catch(e) {};
+ try { o3.outerHTML = "<noscript contenteditable='true'>"; } catch(e) {};
+ try { o4.select(); } catch(e) {};
+ try { o5.addRange(o6); } catch(e) {};
+ try { document.documentElement.appendChild(o1); } catch(e) {};
+ try { o5.selectAllChildren(o1); } catch(e) {};
+ try { o6.selectNode(o1); } catch(e) {};
+</script>
+</head>
+</html> \ No newline at end of file