The Tor Browser: layout/generic/crashtests/397007-1.html@44a2da4a2ab2

Replace accessor implementation with direct member state manipulation, by
request https://trac.torproject.org/projects/tor/ticket/9701#comment:32

     1 <html>

     2 <head>

     3 <script type="text/javascript">

     4 function boom()

5 {

     6   var img = document.createElement("img");

     7   document.getElementById("g").appendChild(img);

     8   img.width = 1;

9 }

    11 </script>

    13 <style type="text/css">

    15 .margin {

    16   margin: 1em 0;

    17 }

    19 .dd:before {

    20   white-space: pre;

    21   line-height: 0;

    22   content: "b";

    23 }

    25 </style>

    27 </head>

    29 <body onload="boom();">

    30 <div style="-moz-column-count: 2;">

    31   X

    32   <div class="margin">y</div>

    33   <span><span id="g"></span>&shy;<div class="margin"></div><span class="dd"><div></div></span></span>

    34 </div>

    35 </body>

    37 </html>

The Tor Browser / file revision