563514-1.html « crashtests « tests « htmlparser « parser - UXP - Unnamed repository; edit this file 'description' to name the repository.

summary refs log tree commit diff stats

path: root/parser/htmlparser/tests/crashtests/563514-1.html

blob: b96ce14661d70ffbf1d6715c87c8623301808460 (plain)

<!DOCTYPE html>
<head>
<script>
function boom()
{
  document.createElement("span").innerHTML = "<body a='b'>";
}
</script>
</head>
<body onload="boom();"></body>