| <html> | |
| <p>This test must not crash.</p> | |
| <script> | |
| if (window.testRunner) | |
| testRunner.dumpAsText(); | |
| function f1() { | |
| document.write('<form>'); //Here we need the form tag to trigger the bug | |
| document.getElementsByTagName("s")[0].innerHTML = 'foo'; | |
| } | |
| function f2() { | |
| try { | |
| document.getElementsByTagName("kbd")[0].innerHTML = 'foo'; | |
| document.getElementsByTagName("kbd")[0].insertBefore(document.createElement('foo'),document.createElement('foo')); | |
| } catch (e) { | |
| // We are not interested in exceptions. | |
| } | |
| } | |
| </script> | |
| <s> | |
| <!-- The following weird mark-up is needed to reproduce the crash --> | |
| <script>f1();</script> | |
| <xmp><mark> | |
| <script>f1();</script> | |
| <xmp></xmp> | |
| <kbd> | |
| <script>f2();</script> | |
| </kbd> | |
| </s> | |
| </html> |