The Tor Browser: js/xpconnect/crashtests/509075-1.html@b8a032363ba2

Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6

     1 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">

     2 <html>

     3   <script>

     5     var txt = document.createTextNode("");

     6     var b = document.createElement("b");

     7     var w = b["watch"];

     8     var txtdg = txt["__lookupGetter__"];

     9     w["__defineGetter__"]("toString",txtdg);

    10     var obj = {

    11       variable: 910,

    12       fun: function() {

    13         w["toString"]();

    14       }

    15     };

    17     function vuln()

    18     {

    19       window.status = "" + obj.variable;

    20       try{

    21         obj.fun();

    22       }catch(er){}

    23       return obj;

    24     }

    26     var ret = vuln();

    27   </script>

    28 </html>

The Tor Browser / file revision