gecko-dev/dom/html/crashtests/1440523.html
Hiroyuki Ikezoe e3cdf865e5 Bug 1440523 - Bail out from nsHTMLDocument::EditingStateChanged if the docshell is being destroyed by FlushPendingNotifications call. r=masayuki
MozReview-Commit-ID: DlFXWdpB1Xv

--HG--
extra : rebase_source : ed93cee34592ad09845c769eac6f56ccdf362457
2018-03-26 11:25:56 +09:00

14 lines
620 B
HTML

<html>
<head>
<script>
try { frame = document.createElement('frame') } catch(e) { }
try { document.documentElement.appendChild(frame) } catch(e) { }
try { contentDocument = frame.contentDocument } catch(e) { }
try { contentDocument.writeln("<p contenteditable='true'>") } catch(e) { }
try { anotherDocument = document.implementation.createHTMLDocument(); } catch(e) { }
try { rootOfAnotherDocument = anotherDocument.documentElement; } catch(e) { }
try { document.replaceChild(rootOfAnotherDocument, document.documentElement); } catch(e) { }
</script>
</head>
</html>