summaryrefslogtreecommitdiff
path: root/layout/generic/crashtests/377522.html
blob: 418fb85521377470823e29ffb4f4c80737aba443 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
<html>
<head>
<script>

function boom() { 
  var div = document.getElementById('div');
  div.appendChild(document.createTextNode(String.fromCharCode(8238)));
  div.appendChild(document.createTextNode(String.fromCharCode(50377)));
  div.appendChild(document.createTextNode(String.fromCharCode(50)));
  div.textContent = div.textContent.slice(1);
}

</script>
</head>
<body onload="boom()">
<div id="div" style="word-spacing:2px; text-align:right">x</div>
</body>
</html>