16 lines
686 B
HTML
16 lines
686 B
HTML
<foo id=test1>>><body id=test2 '><bdi id=test3><keygen>
|
|
<test><script>
|
|
var docElement = document.body ? document.body : document.documentElement;
|
|
function initCF() {
|
|
try { test4 = document.createElementNS("http://www.w3.org/1999/xhtml", "td"); } catch(e) {}
|
|
try { docElement.appendChild(test4); } catch(e) {}
|
|
try { test5 = test3.cloneNode(true); } catch(e) {}
|
|
try { test5.setAttribute("dir", "invalid"); } catch(e) {}
|
|
try { docElement.appendChild(test5); } catch(e) {}
|
|
setTimeout("CFcrash()", 0);
|
|
}
|
|
document.addEventListener("DOMContentLoaded", initCF, false);
|
|
function CFcrash() {
|
|
try { test1.appendChild(test4); } catch(e) {}
|
|
try { document.adoptNode(test2); } catch(e) {}
|
|
}</script>> |