dom/base/crashtests/845093-2.html


1
2
3
4
5
6
7

><bdi id=test1><refa id=test2>&#xf921;>></bdi>><h1 id=test3><script>
document.addEventListener("DOMContentLoaded", CFcrash, false);
function CFcrash() {
test1.setAttribute("dir", "invalid");
test2.textContent = "	&#xf851;S	";
test3.appendChild(test1);
}</script>