xpcom/string/crashtests/395651-1.html

   1 <html>
   2 <head>
   3 <script>
   4
   5 function X() { dump("X\n"); }
   6 function Y() { dump("Y\n"); }
   7
   8 function boom()
   9 {
  10   dump("Start9\n");
  11
  12   var div = document.getElementById("v");
  13
  14   var textNode = document.createTextNode(String.fromCharCode(0xDAAF)); // high surrogate
  15   div.appendChild(textNode);
  16
  17   document.addEventListener("DOMCharacterDataModified", X, true);
  18   textNode.data += 'B';
  19   document.removeEventListener("DOMCharacterDataModified", X, true);
  20
  21   document.addEventListener("DOMAttrModified", Y, true);
  22   textNode.data += String.fromCharCode(0xDF53); // low surrogate
  23   document.removeEventListener("DOMAttrModified", Y, true);
  24 }
  25
  26 </script>
  27 </head>
  28
  29 <body onload="boom();"><div id="v"></div></body>
  30
  31 </html>