Second testcase from bug 838489

2013-11-26 17:09:29 +02:00 · 2013-11-26 17:09:29 +02:00 · 77636ab92b
--- a/content/base/crashtests/838489-2.html
+++ b/content/base/crashtests/838489-2.html
@ -0,0 +1,16 @@
+<foo id=test1>>><body id=test2 '><bdi id=test3><keygen>
+<test><script>
+var docElement = document.body ? document.body : document.documentElement;
+function initCF() {
+try { test4 = document.createElementNS("http://www.w3.org/1999/xhtml", "td"); } catch(e) {}
+try { docElement.appendChild(test4); } catch(e) {}
+try { test5 = test3.cloneNode(true); } catch(e) {}
+try { test5.setAttribute("dir", "invalid"); } catch(e) {}
+try { docElement.appendChild(test5); } catch(e) {}
+setTimeout("CFcrash()", 0);
+}
+document.addEventListener("DOMContentLoaded", initCF, false);
+function CFcrash() {
+try { test1.appendChild(test4); } catch(e) {}
+try { document.adoptNode(test2); } catch(e) {}
+}</script>>
--- a/content/base/crashtests/crashtests.list
+++ b/content/base/crashtests/crashtests.list
@ -130,6 +130,7 @@ load 828054.html
 load 829428.html
 load 836890.html
 load 838489-1.html
+load 838489-2.html
 load 841205.html
 load 844404.html
 load 847127.html