The Tor Browser / file comparison
comparison: dom/xbl/crashtests/336960-1-inner.xhtml
dom/xbl/crashtests/336960-1-inner.xhtml
- branch
- TOR_BUG_3246
- changeset 7
- 129ffea94266
equal
deleted
inserted
replaced
| -1:000000000000 | 0:32b7f602a59c |
|---|---|
| 1 <html xmlns="http://www.w3.org/1999/xhtml"> | |
| 2 <head> | |
| 3 <script> | |
| 4 var x=document.createElementNS('http://www.w3.org/1999/xhtml','style'); | |
| 5 document.documentElement.appendChild(x); | |
| 6 function doe(){ | |
| 7 var y=document.getElementsByTagName('style')[0]; | |
| 8 } | |
| 9 setTimeout(doe,500); | |
| 10 </script> | |
| 11 | |
| 12 <style> | |
| 13 style {-moz-binding:url(#randomxbl);} | |
| 14 </style> | |
| 15 | |
| 16 <bindings xmlns="http://www.mozilla.org/xbl"> | |
| 17 <binding id="randomxbl"> | |
| 18 <implementation> | |
| 19 <constructor> | |
| 20 var x= parent.document.getElementsByTagName('iframe')[0]; | |
| 21 x.parentNode.removeChild(x); | |
| 22 </constructor> | |
| 23 </implementation> | |
| 24 </binding> | |
| 25 </bindings> | |
| 26 </head> | |
| 27 <body> | |
| 28 </body> | |
| 29 </html> |
