608295-1.html (444B)
1 <!DOCTYPE html> 2 <html class="reftest-wait"> 3 <head> 4 <script> 5 6 function boom() 7 { 8 // NB: <script src> is needed to trigger the bug. I'm being clever by also using it to remove reftest-wait. 9 var s = "<script src='data:text/javascript,parent.document.documentElement.className=null;'><\/script><svg>"; 10 document.getElementById("f").contentDocument.write(s); 11 } 12 13 </script> 14 </head> 15 <body onload="boom();"> 16 <iframe id="f"></iframe> 17 </body> 18 </html>