summaryrefslogtreecommitdiffstats
path: root/dom/smil/crashtests/608295-1.html
diff options
context:
space:
mode:
Diffstat (limited to 'dom/smil/crashtests/608295-1.html')
-rw-r--r--dom/smil/crashtests/608295-1.html18
1 files changed, 18 insertions, 0 deletions
diff --git a/dom/smil/crashtests/608295-1.html b/dom/smil/crashtests/608295-1.html
new file mode 100644
index 000000000..354e6f909
--- /dev/null
+++ b/dom/smil/crashtests/608295-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+ // NB: <script src> is needed to trigger the bug. I'm being clever by also using it to remove reftest-wait.
+ var s = "<script src='data:text/javascript,parent.document.documentElement.className=null;'><\/script><svg>";
+ document.getElementById("f").contentDocument.write(s);
+}
+
+</script>
+</head>
+<body onload="boom();">
+<iframe id="f"></iframe>
+</body>
+</html>