summaryrefslogtreecommitdiff
path: root/layout/generic/crashtests/970710.html
blob: 04ca245450a61f2ff4a1a0d1601d5dcb6e798031 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">

<script>

var text =
    "B" +
    "C" +
    "D" +
    "E" +
    "F" +
    "\u0643" +
    "\u0002" +
    "G" +
    "\u202D" +
    "H" +
    "I" +
    " " +
    "\u0007" +
    "";

function boom()
{
    var math = document.createElementNS("http://www.w3.org/1998/Math/MathML", "math");
    var mover = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mover");
    document.body.appendChild(math);
    math.appendChild(mover);
    var textNode = document.createTextNode(text);
    mover.appendChild(textNode);
    document.body.style.display = "table-row-group";
    document.body.style.textAlign = "justify";
}

</script>
</head>

<body onload="boom();"></body>
</html>