The Tor Browser: layout/base/crashtests/522374-1.html@44a2da4a2ab2

Replace accessor implementation with direct member state manipulation, by
request https://trac.torproject.org/projects/tor/ticket/9701#comment:32

     1 <!DOCTYPE html><html class="reftest-wait"><head><script type="text/javascript">

     3 function boom()

4 {

     5   var area = document.getElementById("area");

     6   var main = document.getElementById("main");

     8   area.nextSibling.data += " a ";

     9   document.documentElement.offsetHeight;

    10   area.nextSibling.data = " b ";

    11   main.previousSibling.data += " \u062A ";

    13   document.documentElement.removeAttribute("class");

    14 }

    16 function boom0(ev)

    17 {

    18   setTimeout(boom, 0);

    19 }

    21 </script></head><body onload="boom0();"> <div id="main" style="width: 1px;"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVR42mP4z8AAAAMBAQD3A0FDAAAAAElFTkSuQmCC" usemap="#Map"><map name="Map"><area id="area">        </map></div></body></html>

The Tor Browser / file revision

layout/base/crashtests/522374-1.html@44a2da4a2ab2

layout/base/crashtests/522374-1.html