gecko-dev/dom/html/crashtests/515829-2.html

<!DOCTYPE html>
<html>
<head></head>
<body onload="document.getElementById('x').innerHTML = '<button></button>';">
<form><div id="x"><button></button></div><button></button><input type="image"></form>
</body>
</html>
Bug 515829. Don't assume that mDefaultSubmitElement is non-null just because our firstSubmitSlot contains non-null. r=jst 2009-09-18 18:52:36 +00:00			`<!DOCTYPE html>`
			`<html>`
			`<head></head>`
			`<body onload="document.getElementById('x').innerHTML = '<button></button>';">`
			`<form><div id="x"><button></button></div><button></button><input type="image"></form>`
			`</body>`
			`</html>`