Source code
Revision control
Copy as Markdown
Other Tools
Test Info:
- Manifest: dom/base/crashtests/crashtests.list
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<script>
var frameRoot;
function boom()
{
var frameWin = f.contentWindow;
frameRoot = frameWin.document.documentElement;
frameWin.location.replace("data:text/html;charset=UTF-8,<body onload='parent.g();'>2");
}
function g()
{
setTimeout(h, 0);
}
function h()
{
var newDoc = document.implementation.createDocument('', '', null);
newDoc.adoptNode(frameRoot);
}
</script>
<body onload="boom();">
<iframe id="f" src="data:text/html;charset=UTF-8,<marquee>1"></iframe>
</body>
</html>