Thu, 22 Jan 2015 13:21:57 +0100
Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6
1 <!-- test by moz_bug_r_a4@yahoo.com -->
2 <body onload="a()">
3 <script>
4 var targetUrl = "http://example.com/";
5 var l;
7 function a() {
8 var o = {};
9 o.toString = function() {
10 l();
11 return "a";
12 };
13 var f = Object.getOwnPropertyDescriptor(Document.prototype, "title").set;
14 setTimeout(f.bind(document), 0, o);
15 }
17 function l() {
18 var l = false;
19 onunload = function() {
20 l = true;
21 };
22 location = targetUrl;
23 do {
24 var r = new XMLHttpRequest();
25 r.open("GET", location.href, false);
26 r.overrideMimeType("text/plain");
27 try { r.send(null); }
28 catch (e) {}
29 } while (!l);
30 }
31 </script>