1472024-2.html (537B)
1 <html class="reftest-wait"> 2 <script> 3 function tweak() { 4 document.getElementById('a').appendChild(document.createTextNode('hZ')); 5 document.documentElement.removeAttribute("class"); 6 } 7 8 window.onload = () => { 9 // double-rAF (to ensure layout/paints have been flushed) before we make 10 // the dynamic modification. This seems to make the bug more likely to 11 // reproduce, in unpatched builds. 12 requestAnimationFrame(() => { requestAnimationFrame(() => { 13 tweak(); 14 }); }); 15 }; 16 </script> 17 <table> 18 <tfoot id='a'> 19 <th> 20 <textarea>Text