| <html> |
| <p>This test must not crash.</p> |
| <script> |
| if (window.testRunner) |
| testRunner.dumpAsText(); |
| |
| function f1() { |
| document.write('<form>'); //Here we need the form tag to trigger the bug |
| document.getElementsByTagName("s")[0].innerHTML = 'foo'; |
| } |
| |
| function f2() { |
| try { |
| document.getElementsByTagName("kbd")[0].innerHTML = 'foo'; |
| document.getElementsByTagName("kbd")[0].insertBefore(document.createElement('foo'),document.createElement('foo')); |
| } catch (e) { |
| // We are not interested in exceptions. |
| } |
| } |
| </script> |
| <s> |
| <!-- The following weird mark-up is needed to reproduce the crash --> |
| <script>f1();</script> |
| <xmp><mark> |
| <script>f1();</script> |
| <xmp></xmp> |
| <kbd> |
| <script>f2();</script> |
| </kbd> |
| </s> |
| </html> |