The Tor Browser: diff layout/generic/crashtests/392698-1.html

     1.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     1.2 +++ b/layout/generic/crashtests/392698-1.html	Wed Dec 31 06:09:35 2014 +0100
     1.3 @@ -0,0 +1,16 @@
     1.4 +<!DOCTYPE html>
     1.5 +<html>
     1.6 +<head>
     1.7 +  <script type="application/javascript">
     1.8 +window.onload = function()
     1.9 +{
    1.10 +  document.getElementById("i")
    1.11 +          .setAttribute("width", 100);
    1.12 +};
    1.13 +  </script>
    1.14 +</head>
    1.15 +<body>
    1.16 +<iframe src="data:text/html,&lt;div style='position:fixed'&gt;foo&lt;/div&gt;"
    1.17 +        id="i" width="75" height="150"></iframe>
    1.18 +</body>
    1.19 +</html>

The Tor Browser / file diff

diff: layout/generic/crashtests/392698-1.html

layout/generic/crashtests/392698-1.html