dom/base/crashtests/700090-1.html

   1 <!DOCTYPE html>
   2 <html>
   3 <head>
   4 <script>
   5
   6 function boom()
   7 {
   8   var mo = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mo");
   9   var t1 = document.createTextNode("123456 ");
  10   mo.appendChild(t1);
  11   document.body.appendChild(mo);
  12   var t2 = document.createTextNode("x");
  13   document.body.appendChild(t2);
  14
  15   var r1 = document.createRange();
  16   r1.setEnd(t1, 7);
  17   var r3 = document.createRange();
  18   r3.setStart(t1, 7);
  19
  20   document.documentElement.offsetHeight;
  21
  22   var r2 = document.createRange();
  23   r2.setStart(t1, 0);
  24   r2.setEnd(t2, 0);
  25   r2.deleteContents();
  26 }
  27
  28 </script>
  29 </head>
  30
  31 <body onload="boom();"></body>
  32 </html>