summaryrefslogtreecommitdiff
path: root/dom/html/crashtests/673853.html
blob: 1325fa9ed6b27902872d7e8adfc03af5f4229fbb (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
<!DOCTYPE html>
<html>
<head>
<script>

function boom()
{
  var otherDoc = document.implementation.createDocument('', '', null);
  var input = otherDoc.createElementNS("http://www.w3.org/1999/xhtml", "input");
  var form = otherDoc.createElementNS("http://www.w3.org/1999/xhtml", "form");
  input.setAttributeNS(null, "form", "x");
  form.setAttributeNS(null, "id", "x");
  input.appendChild(form);
  otherDoc.appendChild(input);
}

</script>
</head>
<body onload="boom();"></body>
</html>