summaryrefslogtreecommitdiffstats
path: root/dom/xbl/crashtests/406904-2.xhtml
diff options
context:
space:
mode:
Diffstat (limited to 'dom/xbl/crashtests/406904-2.xhtml')
-rw-r--r--dom/xbl/crashtests/406904-2.xhtml25
1 files changed, 25 insertions, 0 deletions
diff --git a/dom/xbl/crashtests/406904-2.xhtml b/dom/xbl/crashtests/406904-2.xhtml
new file mode 100644
index 000000000..763672b3f
--- /dev/null
+++ b/dom/xbl/crashtests/406904-2.xhtml
@@ -0,0 +1,25 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xbl="http://www.mozilla.org/xbl">
+<head>
+
+<xbl:bindings xmlns="http://www.mozilla.org/xbl"><xbl:binding id="a"><xbl:content>
+<span><span></span><xbl:children/></span>
+</xbl:content></xbl:binding></xbl:bindings>
+
+<script type="text/javascript">
+
+function boom()
+{
+ var s = document.getElementById("s");
+ var anon = document.getAnonymousNodes(s)[0];
+
+ while (anon.firstChild)
+ anon.removeChild(anon.firstChild);
+
+ document.documentElement.style.MozBinding = "url('data:text/xml,%3Cbindings%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fxbl%22%3E%3Cbinding%20id%3D%22foo%22%3E%3Ccontent%3EQ%3C%2Fcontent%3E%3C%2Fbinding%3E%3C%2Fbindings%3E%0A')";
+}
+
+</script>
+</head>
+
+<body onload="boom();"><span id="s" style="-moz-binding: url('#a');"></span></body>
+</html>