610571-1.html (764B)
1 <!DOCTYPE html> 2 <html class="reftest-wait"> 3 <head> 4 <script> 5 6 function boom() 7 { 8 var frame1 = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe"); frame1.src = "data:text/html,1"; document.body.appendChild(frame1); 9 var frame2 = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe"); frame2.src = "data:text/html,2"; document.body.appendChild(frame2); 10 var frame1doc = frame1.contentDocument; 11 var frame1root = frame1doc.documentElement; 12 frame1root.appendChild(frame2); 13 setTimeout(function() { 14 try { 15 frame2.contentDocument.q = frame1root.__lookupGetter__("nextSibling"); 16 } catch(ex) {} 17 document.documentElement.removeAttribute("class"); 18 }, 200); 19 } 20 21 </script> 22 </head> 23 24 <body onload="boom();"></body> 25 </html>