blob: af084e417606abecb36a1e13577a39385df1729d (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
|
<url id=test1></url>><listing id=test2>
A[]@q
<root id=test3><bdi dir=ltr id=test4><script>
var docElement = document.body ? document.body : document.documentElement;
function initCF() {
try { test5 = document.createElementNS("http://www.w3.org/2000/svg", "symbol"); } catch(e) {}
setTimeout("CFcrash()", 231);
}
document.addEventListener("DOMContentLoaded", initCF, false);
function CFcrash() {
try { if (test1 != docElement) { test1.parentNode.removeChild(test1); test1 = test4; }} catch(e) {}
try { if (test1 != docElement) { test1.parentNode.removeChild(test1); }} catch(e) {}
try { test4.appendChild(test3); } catch(e) {}
try { test3.appendChild(test2); } catch(e) {}
try { test4.setAttribute("dir", "invalid"); } catch(e) {}
setTimeout('try { test5.appendChild(test4); } catch(e) {}', 343);
try { test2.innerHTML = "W?bj; 