<!DOCTYPE html> <html class="reftest-wait"> <head> <script type="text/javascript"> var img = document.createElement("img"); img.setAttributeNS(null, "usemap", "#map"); img.setAttributeNS(null, "src", "data:image/gif;base64,R0lGODlhEwATAKIAAP//AMzMADMzAP8AAAAAAP///wAAAAAAACH5BAEAAAUALAAAAAATABMAAANWWLrUTisyEoC1oUlFr8dQRHykFRad+Y0gdzlv86KVKdsskOUAjHu312rFK5FuxaMNIMgYe85GrVfKZVDAR7DHmVoG4IHn6vqEgZLU90xOq8OazUS7SQAAOw=="); function boom() { map = document.createElement("map"); map.setAttributeNS(null, "name", "map"); area = document.createElement("area"); map.appendChild(area); span = document.createElement("span"); span.appendChild(img); td = document.createElement("td"); span.appendChild(td); map.appendChild(span); document.body.appendChild(map); boom2(); } function boom2() { // For reliable reproduction, need a flush here. var x = document.body.offsetWidth; // needs to be async, apparently. setTimeout(boom3, 0); } function boom3() { span.parentNode.removeChild(span); document.documentElement.removeAttribute("class"); } </script> </head> <body onload="boom();"></body> </html>