Bug 580151 - Part 3: crashtest; r=roc

--HG-- extra : rebase_source : 7b0f6b55c8977d3a3b2b1ef61e5a727f2959badc
2010-07-20 09:21:44 -04:00 · 2010-07-20 09:21:44 -04:00 · 04bf955322
--- a/editor/libeditor/text/crashtests/580151-1.xhtml
+++ b/editor/libeditor/text/crashtests/580151-1.xhtml
@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+var t;
+
+function boom()
+{
+  var b = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
+  t = document.createElementNS("http://www.w3.org/1999/xhtml", "textarea");
+  b.appendChild(t);
+  document.removeChild(document.documentElement)
+  document.appendChild(b)
+  document.removeChild(document.documentElement)
+  var ns = document.createElementNS("http://www.w3.org/1999/xhtml", "script");
+  var nt = document.createTextNode("t.appendChild(document.createTextNode(' '));");
+  ns.appendChild(nt);
+  b.appendChild(ns);
+  document.appendChild(b);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
--- a/editor/libeditor/text/crashtests/crashtests.list
+++ b/editor/libeditor/text/crashtests/crashtests.list
@ -1 +1,2 @@
 load 403965-1.xhtml
+load 580151-1.xhtml