gecko-dev/layout/style/crashtests/1404180-1.html
Cameron McCormack 6fdd311839 Bug 1404180 - Don't allow associating form elements by ID to <form>s across anonymous subtree boundaries. r=smaug
MozReview-Commit-ID: KRJjrkL4FgZ

--HG--
extra : amend_source : 80cd5e00804a8b2a5fd4e51b0f7ea9160dd63b1c
2017-10-02 13:10:18 +08:00

23 lines
636 B
HTML

<script>
function jsfuzzer() {
try { htmlvar00016.appendChild(htmlvar00017); } catch(e) { }
try { htmlvar00016.form.setAttribute("novalidate", "novalidate"); } catch(e) { }
try { htmlvar00017.appendChild(htmlvar00036); } catch(e) { }
try { svgvar00007.appendChild(htmlvar00008); } catch(e) { }
}
</script>
<body onload=jsfuzzer()>
<form id="htmlvar00007">
<legend id="htmlvar00008">
<output id="htmlvar00016"></output>
</legend>
<link id="htmlvar00017"></link>
<svg>
<path id="svgvar00006">
<animateTransform id="svgvar00007"/>
</path>
<use xlink:href="#svgvar00006">
<table id="htmlvar00036">
<th>
<output form="htmlvar00007">