Wed, 31 Dec 2014 06:09:35 +0100
Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.
michael@0 | 1 | <noframes dir=auto id=test4></noframes><vbox id=test5>K<csaction id=test3><script> |
michael@0 | 2 | function reference(domNode) { this.domNode = domNode;} function walk(a, currentPrefix, index, domNode) { if(domNode == null) return; newPrefix = currentPrefix + "_" + index; walk(a, domNode.nextSibling); walk(a, domNode.firstChild); a[newPrefix] = new reference(domNode); } function clear() { var a = new Array(); walk(a, "", 0, document.documentElement); for(key in a) {a[key].domNode.parentNode.removeChild(a[key].domNode); }} |
michael@0 | 3 | function crash() { |
michael@0 | 4 | try { test1 = document.createElementNS("http://www.w3.org/2000/svg", "text"); } catch(e) {} |
michael@0 | 5 | try { test2 = test3.cloneNode(true); } catch(e) {} |
michael@0 | 6 | setTimeout("try { clear(); } catch(e) {}", 500); |
michael@0 | 7 | try { test1.appendChild(test5); } catch(e) {} |
michael@0 | 8 | try { test2.appendChild(test1); } catch(e) {} |
michael@0 | 9 | try { test4.appendChild(test2); } catch(e) {} |
michael@0 | 10 | try { test5.innerHTML = ""; } catch(e) {} |
michael@0 | 11 | } |
michael@0 | 12 | document.addEventListener("DOMContentLoaded", crash, false); |
michael@0 | 13 | </script> |