diff options
Diffstat (limited to 'dom/svg/crashtests/1282985-1.svg')
| -rw-r--r-- | dom/svg/crashtests/1282985-1.svg | 24 |
1 files changed, 24 insertions, 0 deletions
diff --git a/dom/svg/crashtests/1282985-1.svg b/dom/svg/crashtests/1282985-1.svg new file mode 100644 index 000000000..e0d838917 --- /dev/null +++ b/dom/svg/crashtests/1282985-1.svg @@ -0,0 +1,24 @@ +<svg xmlns="http://www.w3.org/2000/svg"> +<script> +<![CDATA[ + +function boom() { + var g = document.createElementNS("http://www.w3.org/2000/svg", "g"); + g.setAttribute("id", "g"); + var iframe = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe"); + g.appendChild(iframe); + document.documentElement.appendChild(g); + var use = document.createElementNS("http://www.w3.org/2000/svg", "use"); + use.setAttributeNS("http://www.w3.org/1999/xlink", "xlink:href", "#g"); + document.documentElement.appendChild(use); + setTimeout(function() { + setTimeout(function() { + g.appendChild(document.createElementNS("http://www.w3.org/1999/xhtml", "video")); + }, 3); + }, 3); +} +window.addEventListener("load", boom, false); + +]]> +</script> +</svg> |