summaryrefslogtreecommitdiffstats
path: root/parser/htmlparser/tests/crashtests/502869-iframe.html
diff options
context:
space:
mode:
Diffstat (limited to 'parser/htmlparser/tests/crashtests/502869-iframe.html')
-rw-r--r--parser/htmlparser/tests/crashtests/502869-iframe.html9
1 files changed, 9 insertions, 0 deletions
diff --git a/parser/htmlparser/tests/crashtests/502869-iframe.html b/parser/htmlparser/tests/crashtests/502869-iframe.html
new file mode 100644
index 000000000..cbd1908f4
--- /dev/null
+++ b/parser/htmlparser/tests/crashtests/502869-iframe.html
@@ -0,0 +1,9 @@
+<html><head><title>[HTML5] Crash [@ nsHtml5TreeBuilder::appendToCurrentNodeAndPushElementMayFoster] with document.write and removing stuff</title></head><body><a>
+<script>
+var x=document.getElementsByTagName("*");
+x[1].parentNode.removeChild(x[1]);
+x[2].parentNode.removeChild(x[2]);
+</script>
+<div>
+<script>document.write('<'+'script>document.removeChild(document.documentElement);<'+'/script>');</script>
+</a></body></html>