The Tor Browser: dom/smil/crashtests/641388-1.html@6474c204b198

Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.

     1 <script>

     3 var ar = new Array(100000);

     5 function fill() {

     6         var s = unescape("%ubeef%udead%udead%udead%u0000%u0000%u3030%u3030");

     7         while(s.length < 0x40000) {

     8                 for(var x=0; x<100; x++) ar.push(s+s);

     9                 s+=s;

    10         }

    11 }

    14 function gc() {

    15                 var evt = document.createEvent("Events");

    16                 evt.initEvent("please-gc", true, false);

    17                 document.dispatchEvent(evt);

    18 		fill();

    19 }

    22 gc();

    23 function start(){

    24 tmp = document.createElement('iframe');

    25 tmp.src="data:image/svg+xml,"+escape("<?xml version='1.0' standalone='no'?><!DOCTYPE svg><svg xmlns='http://www.w3.org/2000/svg'><defs id='element1'></defs><g id='element5'></g></svg>");

    26 tmp.id = 'ifr23282';

    27 try{document.getElementById('store_div').appendChild(tmp);}catch(e){}

    28 window.setTimeout('startrly()', 100);

    29 } function startrly() {

    30 try{o6=document.createComment(null);}catch(e){}

    31 try{o9=document.getElementById('ifr23282').contentDocument.documentElement;;}catch(e){}

    32 try{o13=document.getElementById('ifr23282').contentDocument.getElementById('element1');;}catch(e){}

    33 try{o15=document.getElementById('ifr23282').contentDocument.getElementById('element5');;}catch(e){}

    34 try{tmp = document.createElement('iframe');}catch(e){}

    35 try{tmp.id = 'ifr6690';}catch(e){}

    36 try{o6.ownerDocument.documentElement.appendChild(tmp);}catch(e){}

    37 window.setTimeout('start_dataiframe0()',100);

    38 } function start_dataiframe0(){

    39 try{o19=o6.ownerDocument.getElementById('ifr6690').contentDocument.documentElement;;}catch(e){}

    40 try{o24=document.createElementNS('http://www.w3.org/1998/Math/MathML','annotation-xml');;}catch(e){}

    41 try{o35=document.createElementNS('http://www.w3.org/1998/Math/MathML','emptyset');;}catch(e){}

    42 try{o40=o19.cloneNode(false);;}catch(e){}

    43 try{o19.appendChild(o13);}catch(e){}

    44 try{o19.appendChild(o15);}catch(e){}

    45 try{o24.appendChild(o40);}catch(e){}

    46 try{tmp = document.createElement('iframe');}catch(e){}

    47 tmp.src="data:text/html,<article%20id='element1'></article><command%20id='element3'></command>";

    48 try{tmp.id = 'ifr17516';}catch(e){}

    49 try{o13.ownerDocument.documentElement.appendChild(tmp);}catch(e){}

    50 window.setTimeout('start_dataiframe4()',100);

    51 } function start_dataiframe4(){

    52 try{o62=o13.ownerDocument.getElementById('ifr17516').contentDocument.getElementById('element1');;}catch(e){}

    53 try{tmp.id = 'ifr2522';}catch(e){}

    54 try{o101=o15.ownerDocument.getElementById('ifr2522').contentDocument.getElementById('element3');;}catch(e){}

    55 try{o101.appendChild(o24);}catch(e){}

    56 try{o109=o35.setUserData('key',null,function (o,k,d,s,ds) { gc(); });;}catch(e){}

    57 try{o112=document.createElementNS('http://www.w3.org/1999/xhtml', 'script');;}catch(e){}

    58 try{o124=document.createElementNS('http://www.w3.org/1998/Math/MathML','root');;}catch(e){}

    59 try{o125=document.createElementNS('http://www.w3.org/2000/svg','font-face');;}catch(e){}

    60 gc()

    61 try{o150=o40;}catch(e){}

    62 try{tmp.id = 'ifr44501';}catch(e){}

    63 try{o124.ownerDocument.documentElement.appendChild(tmp);}catch(e){}

    64 window.setTimeout('start_dataiframe7()',100);

    65 } function start_dataiframe7(){

    66 try{o152=o124.ownerDocument.getElementById('ifr44501').contentDocument.documentElement;;}catch(e){}

    67 try{tmp = document.createElement('iframe');}catch(e){}

    68 try{tmp.src="data:text/html,<div%20id='element1'></div>";}catch(e){}

    69 try{tmp.id = 'ifr55543';}catch(e){}

    70 try{o125.ownerDocument.documentElement.appendChild(tmp);}catch(e){}

    71 window.setTimeout('start_dataiframe10()',100);

    72 } function start_dataiframe10(){

    73 try{o198=o125.ownerDocument.getElementById('ifr55543').contentDocument.getElementById('element1');;}catch(e){}

    74 try{o152.appendChild(o101);}catch(e){}

    75 try{o152.ownerDocument.documentElement.appendChild(tmp);}catch(e){}

    76 window.setTimeout('start_dataiframe17()',100);

    77 } function start_dataiframe17(){

    78 try{o286=o152.ownerDocument.getElementById('ifr55543').contentDocument.documentElement;;}catch(e){}

    79 try{o288=o152.ownerDocument.getElementById('ifr55543').contentDocument.getElementById('element1');;}catch(e){}

    80 try{o349=document.createElementNS('http://www.w3.org/2000/svg','animate');;}catch(e){}

    81 try{o150.appendChild(o349);}catch(e){}

    82 try{o288.appendChild(o150);}catch(e){}

    83 try{o198.appendChild(o349);}catch(e){}

    84 window.setTimeout('start_dataiframe24()',100);

    85 } function start_dataiframe24(){

    86 try{o286.appendChild(o9);}catch(e){}

    87 try{o62.appendChild(o152);}catch(e){}

    88 try{o112.appendChild(o286);}catch(e){}

    89 try{o534=o35.cloneNode(false);;}catch(e){}

    90 gc();

    91 o35 = null;

    92 gc();

    93 window.setTimeout("fill()",300);

    94 }

    95 </script>

    96 <body onload="start()">

    97 <div id="store_div"></div>

    98 </body>

The Tor Browser / file revision

dom/smil/crashtests/641388-1.html@6474c204b198

dom/smil/crashtests/641388-1.html