Fri, 16 Jan 2015 04:50:19 +0100
Replace accessor implementation with direct member state manipulation, by
request https://trac.torproject.org/projects/tor/ticket/9701#comment:32
1 <html>
2 <head>
3 <script>
4 function init2() {
5 var one = document.getElementById('one');
6 var two = document.getElementById('two');
7 var three = document.getElementById('three');
8 var four = document.getElementById('four');
10 four.appendChild(two);
11 document.getElementsByTagName('tbody')[0].appendChild(three);
12 four.appendChild(three);
13 one.appendChild(four);
14 document.getElementsByTagName('table')[0].appendChild(one);
15 setTimeout('clickit()', 0);
16 }
18 function doe(){
19 four.parentNode.removeChild(four);
20 }
22 function clickit()
23 {
24 var evt = document.createEvent("MouseEvents");
25 evt.initMouseEvent("click", true, true, window, 0, 0, 0, 0, 0, false, false, false, false, 0, null);
26 document.body.dispatchEvent(evt);
27 }
29 window.addEventListener("load", init2, 0);
30 window.addEventListener("click", doe, 0);
31 </script>
32 </head>
33 <body>
34 <table style="border-collapse: collapse;"><tbody>
35 <tr> <td rowspan="5">P</td> <td id="three">6</td> <td>O</td> </tr>
36 <tr> <td id="four">5</td> <td>P</td> </tr>
37 <tr id="five"> <td>5</td> <td>U</td> </tr>
38 <tr id="one"> <td>6</td> <td>S</td> </tr>
39 <tr id="two"> <td>S</td> <td>9</td> </tr>
40 </tbody></table>
41 Mozilla should not crash when clicking in the document
42 </body></html>