blob: 3dfad160c1c6e66665734b87bd52bb5c5e7cb24d (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
|
<html>
<head>
<script>
// Document must not have a doctype to trigger the bug
function boom()
{
var root = document.documentElement;
while (root.firstChild) { root.removeChild(root.firstChild); }
root.contentEditable = "true";
document.removeChild(root);
document.appendChild(root);
window.getSelection().collapse(root, 0);
window.getSelection().extend(document, 1);
document.removeChild(root);
}
</script>
</head>
<body onload="boom();"></body>
</html>
|
