The Tor Browser: layout/base/crashtests/497519-2.xhtml@44a2da4a2ab2

Replace accessor implementation with direct member state manipulation, by
request https://trac.torproject.org/projects/tor/ticket/9701#comment:32

     1 <html xmlns="http://www.w3.org/1999/xhtml" style="-moz-binding: url(#foo)">

     2 <head>

     4 <xbl:bindings xmlns:xbl="http://www.mozilla.org/xbl">

     5 <xbl:binding id="foo"><xbl:content><fieldset><xbl:children/></fieldset></xbl:content></xbl:binding>

     6 </xbl:bindings>

     8 <script type="text/javascript">

    10 function boom()

    11 {

    12   var dE = document.documentElement;

    13   var leg = document.createElementNS("http://www.w3.org/1999/xhtml", "legend");

    14   leg.style.cssFloat = "left";

    15   dE.appendChild(leg);

    16   document.documentElement.offsetHeight;

    17   dE.removeChild(leg);

    18 }

    20 </script>

    22 </head>

    24 <body onload="boom();"></body>

    26 </html>

The Tor Browser / file revision