summaryrefslogtreecommitdiff
path: root/dom/base/crashtests/1251361.html
blob: 57c76121f525c4c6041f145d9994c645cf25258b (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<script>

var frameRoot;

function boom()
{
    var frameWin = f.contentWindow;
    frameRoot = frameWin.document.documentElement;
    frameWin.location.replace("data:text/html;charset=UTF-8,<body onload='parent.g();'>2");
}

function g()
{
    setTimeout(h, 0);
}

function h()
{
    var newDoc = document.implementation.createDocument('', '', null);
    newDoc.adoptNode(frameRoot);
}

</script>
<body onload="boom();">

<iframe id="f" src="data:text/html;charset=UTF-8,<marquee>1"></iframe>

</body>
</html>