gecko-dev/parser/htmlparser/tests/crashtests/563514-1.html
Henri Sivonen 99037edab1 Bug 563514 - Avoid leaking or misplacing attributes on stray <html> and <body> tokens in the innerHTML case. r=jonas.
--HG--
extra : rebase_source : 174666b3ec6c0a7e6251fe34b6bf23c499ad3575
2010-06-09 09:44:25 +03:00

10 lines
161 B
HTML

<!DOCTYPE html>
<head>
<script>
function boom()
{
document.createElement("span").innerHTML = "<body a='b'>";
}
</script>
</head>
<body onload="boom();"></body>