490777-1.html (471B)
1 <!-- This crashed on Mac OS X with the modified ATSUI font backend implemented in 2 bug 481948. Crash occurs due to an unpaired low surrogate in text with the 3 right-to-left direction override; this cannot occur in direct HTML content 4 because the unpaired surrogate will be replaced with U+FFFD, but it can be 5 generated from Javascript. --> 6 <html> 7 <body onload="document.body.appendChild(document.createTextNode('\u202E\u4839\uDC1D'));"> 8 </body> 9 </html>