dom/base/crashtests/420620-1.html

   1 <!DOCTYPE html>
   2 <html>
   3 <head>
   4 <script type="text/javascript">
   5
   6 function boom()
   7 {
   8   var a = document.documentElement;
   9   var b = document.body;
  10
  11   document.removeChild(a);
  12   b.contentEditable = "true";
  13   document.appendChild(a);
  14
  15   function t() {
  16     document.removeEventListener("DOMAttrModified", t);
  17     document.removeChild(a);
  18   }
  19
  20   document.addEventListener("DOMAttrModified", t);
  21   document.execCommand("insertunorderedlist", false, "<h1>");
  22   document.removeEventListener("DOMAttrModified", t);
  23 }
  24
  25 </script>
  26 </head>
  27
  28 <body onload="boom()"></body>
  29 </html>