summaryrefslogtreecommitdiff
path: root/layout/generic/crashtests/927558.html
blob: b1da65f278fcae7c6f740f32b0ac44a3984f9706 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
<!DOCTYPE html>
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta charset="UTF-8">
<script>

function boom()
{
  var range = document.createRange();
  range.setStart(document.documentElement, 0);
  var frame = document.getElementById("f");
  var frameSel = frame.contentWindow.getSelection();
  document.body.removeChild(frame);
  frameSel.addRange(range);
  frameSel.modify("move", "right", "character");
}

</script>
</head>

<body onload="boom();">
<iframe id="f" src="data:text/html,<!doctype html>1"></iframe>


</body></html>