summaryrefslogtreecommitdiff
path: root/layout/base/crashtests/580129-1.html
blob: 228051b5a438c8e0fdbc5058cc8c5cbc39ae5989 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
<html>
<head>
<script>

function boom()
{
  var a = document.documentElement;
  var b = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
  b.setAttributeNS(null, "style", "-moz-column-width: 20em;");
  a.innerHTML = "<frameset>";
  b.innerHTML = "<dd><marquee>x";
  document.removeChild(a);
  document.appendChild(b);
}

</script>
</head>
<body onload="boom();"></body>
</html>