summaryrefslogtreecommitdiff
path: root/dom/base/crashtests/836890.html
blob: a75fa3c45f50ddcd243546bfec1d9fa9aaabc8da (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
<!DOCTYPE html>
<html>
<head>
<script>

function boom()
{
  var outer = document.createElement("span");
  var inner = document.createElement("span");
  outer.dir = "auto";
  outer.appendChild(inner);
  inner.appendChild(document.createTextNode("x"));
  inner.dir = "auto";
}

</script>
</head>
<body onload="boom();"></body>
</html>