The Tor Browser / file comparison
comparison: js/xpconnect/crashtests/453935-1.html
js/xpconnect/crashtests/453935-1.html
- changeset 0
- 6474c204b198
equal
deleted
inserted
replaced
| -1:000000000000 | 0:2e64c729450c |
|---|---|
| 1 <!DOCTYPE html> | |
| 2 <html> | |
| 3 <head> | |
| 4 <script type="text/javascript"> | |
| 5 | |
| 6 function boom() | |
| 7 { | |
| 8 var a = []; | |
| 9 a[31] = undefined; | |
| 10 a[40] = undefined; | |
| 11 a[44] = {}; | |
| 12 a[45] = new XMLHttpRequest(); | |
| 13 a[48] = new XMLHttpRequest(); | |
| 14 a[53] = XMLHttpRequest.prototype; | |
| 15 a[53].__proto__ = {}; | |
| 16 a[53].nodeType = 100; | |
| 17 search(a, 41); | |
| 18 } | |
| 19 | |
| 20 | |
| 21 function search(a, start) | |
| 22 { | |
| 23 var N = a.length; | |
| 24 | |
| 25 for (var j = start; j < N; ++j) { | |
| 26 var e = a[j]; | |
| 27 if (typeof e == "object" && "nodeType" in e && e.nodeType == 99) | |
| 28 return j; | |
| 29 } | |
| 30 | |
| 31 return null; | |
| 32 } | |
| 33 | |
| 34 </script> | |
| 35 </head> | |
| 36 <body onload="boom();"></body> | |
| 37 </html> |
