Testcase from bug 847127, r=ehsan

2013-03-07 22:53:07 +02:00 · 2013-03-07 22:53:07 +02:00 · 46cd9600a9
--- a/content/base/crashtests/847127.html
+++ b/content/base/crashtests/847127.html
@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var outer = document.createElement("span");
+  outer.dir = "auto";
+  var inner = document.createElement("span");
+  outer.appendChild(inner);
+  inner.appendChild(document.createTextNode("\u202B"));
+  inner.dir = "auto";
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
--- a/content/base/crashtests/crashtests.list
+++ b/content/base/crashtests/crashtests.list
@ -131,3 +131,4 @@ load 829428.html
 load 836890.html
 load 841205.html
 load 844404.html
+load 847127.html