The Tor Browser: layout/base/crashtests/394150-1.xhtml@44a2da4a2ab2

Replace accessor implementation with direct member state manipulation, by
request https://trac.torproject.org/projects/tor/ticket/9701#comment:32

     1 <html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">

     2 <head>

     3 <script>

     5 function boom()

6 {

     7   var ms = document.createElementNS("http://www.w3.org/1998/Math/MathML", "ms");

     8   var textNode = document.getElementById("emptyset").firstChild;

     9   var mrow = document.getElementById("mrow");

    11   ms.appendChild(textNode); // *move* the text node from one place to another!

    12   mrow.appendChild(ms);

    13 }

    15 </script>

    16 </head>

    18 <body onload="boom();">

    20 <math xmlns="http://www.w3.org/1998/Math/MathML">

    21 <merror><emptyset id="emptyset">

    22   <mrow id="mrow"></mrow></emptyset></merror>

    23 </math>

    25 </body>

    27 </html>

The Tor Browser / file revision