767169.html (465B)
1 <html> 2 <head> 3 <script> 4 5 // Document must not have a doctype to trigger the bug 6 7 function boom() 8 { 9 var root = document.documentElement; 10 while (root.firstChild) { root.firstChild.remove(); } 11 root.contentEditable = "true"; 12 document.removeChild(root); 13 document.appendChild(root); 14 window.getSelection().collapse(root, 0); 15 window.getSelection().extend(document, 1); 16 document.removeChild(root); 17 } 18 19 </script> 20 </head> 21 22 <body onload="boom();"></body> 23 </html>