dom/base/crashtests/836890.html


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

<!DOCTYPE html>
<html>
<head>
<script>

function boom()
{
  var outer = document.createElement("span");
  var inner = document.createElement("span");
  outer.dir = "auto";
  outer.appendChild(inner);
  inner.appendChild(document.createTextNode("x"));
  inner.dir = "auto";
}

</script>
</head>
<body onload="boom();"></body>
</html>