| <html><!-- webkit-test-runner [ KeygenElementEnabled=true ] --> |
| <head> |
| <style> |
| .c2 { display: table-caption; position: relative; } |
| .c9 { visibility: collapse; height: 65536px; } |
| .c15 { display: inline; float: right;} |
| </style> |
| <script> |
| if (window.testRunner) { |
| testRunner.waitUntilDone(); |
| } |
| |
| var nodes = Array(); |
| |
| function tryToCrash() |
| { |
| document.execCommand("SelectAll", false, ""); |
| setTimeout('testRunner.notifyDone();',1000); |
| } |
| |
| function boom() { |
| try { nodes[3] = document.createElement('tbody'); } catch(e) {} |
| try { nodes[3].setAttribute('class', 'c2'); } catch(e) {} |
| try { document.documentElement.appendChild(nodes[3]); } catch(e) {} |
| try { nodes[4] = document.createElement('col'); } catch(e) {} |
| try { nodes[4].setAttribute('class', 'c15'); } catch(e) {} |
| try { nodes[3].appendChild(nodes[4]); } catch(e) {} |
| try { nodes[6] = document.createElement('keygen'); } catch(e) {} |
| try { nodes[6].setAttribute('class', 'c2'); } catch(e) {} |
| try { document.documentElement.appendChild(nodes[6]); } catch(e) {} |
| try { nodes[8] = document.createElement('a'); } catch(e) {} |
| try { nodes[4].appendChild(nodes[8]); } catch(e) {} |
| try { nodes[21] = document.createElement('tr'); } catch(e) {} |
| try { nodes[21].setAttribute('class', 'c9'); } catch(e) {} |
| try { nodes[8].appendChild(nodes[21]); } catch(e) {} |
| try { nodes[29] = document.createElement('caption'); } catch(e) {} |
| setTimeout('try { nodes[29].appendChild(nodes[4]); } catch(e) {}', 561); |
| setTimeout('window.scrollBy(-37, 59);', 203); |
| setTimeout('tryToCrash();', 402); |
| } |
| </script> |
| </head> |
| <body onLoad="setTimeout('boom();',0)"> |
| Passes if it doesn't crash! |
| </body> |
| </html> |
