382568-1-inner.xhtml (1255B)
1 <?xml version="1.0"?> 2 <!DOCTYPE html 3 PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" 4 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> 5 <html xmlns="http://www.w3.org/1999/xhtml"> <head> 6 <title>Test</title> 7 <script type="text/javascript"><![CDATA[ 8 9 function onAttrModified(evt) { 10 // window.alert("Mutation event fired within the frame code."); 11 // evt.target.focus(); 12 // evt.target.blur(); 13 evt.target.style.background = 'green'; 14 bounce(evt.target); 15 // evt.target.normalize(); 16 // bounce(evt.target.parentNode); 17 } 18 function die(n) { 19 p = n.parentNode; 20 p.removeChild(n); 21 } 22 23 function bounce(n) { 24 p = n.parentNode; 25 p.removeChild(n); 26 p.appendChild(n); 27 } 28 29 30 function test_AttrModified() { 31 var x = document.getElementById("x"); 32 x.addEventListener("DOMAttrModified", onAttrModified); 33 bounce(x); 34 } 35 36 function test() { 37 setTimeout(test_AttrModified, 3000); 38 } 39 ]]></script> 40 </head> 41 42 <body onload="test()"> 43 <h1>TestCase for unsafe mutable events from textarea</h1> 44 <p>Please wait for 3 seconds after document was loaded, 45 if your browser is vulnerable, it may stop responding 46 to keyboard and mouse event 47 and most likely it will eventually crash (may take a 48 while for debug builds).</p> 49 <p> 50 <textarea id="x"></textarea> 51 </p> 52 </body> </html>