bug445004-inner.js (737B)
1 document.domain = "example.org"; 2 function $(str) { 3 return document.getElementById(str); 4 } 5 function hookLoad(str) { 6 $(str).onload = function () { 7 window.parent.parent.postMessage("end", "*"); 8 }; 9 window.parent.parent.postMessage("start", "*"); 10 } 11 window.onload = function () { 12 hookLoad("w"); 13 $("w").contentWindow.location.href = "test1.example.org.png"; 14 hookLoad("x"); 15 var doc = $("x").contentDocument; 16 doc.write('<img src="test1.example.org.png">'); 17 doc.close(); 18 }; 19 function doIt() { 20 hookLoad("y"); 21 $("y").contentWindow.location.href = "example.org.png"; 22 hookLoad("z"); 23 var doc = $("z").contentDocument; 24 doc.write('<img src="example.org.png">'); 25 doc.close(); 26 } 27 window.addEventListener("message", doIt);