453935-1.html (590B)
1 <!DOCTYPE html> 2 <html> 3 <head> 4 <script type="text/javascript"> 5 6 function boom() 7 { 8 var a = []; 9 a[31] = undefined; 10 a[40] = undefined; 11 a[44] = {}; 12 a[45] = new XMLHttpRequest(); 13 a[48] = new XMLHttpRequest(); 14 a[53] = XMLHttpRequest.prototype; 15 a[53].__proto__ = {}; 16 a[53].nodeType = 100; 17 search(a, 41); 18 } 19 20 21 function search(a, start) 22 { 23 var N = a.length; 24 25 for (var j = start; j < N; ++j) { 26 var e = a[j]; 27 if (typeof e == "object" && "nodeType" in e && e.nodeType == 99) 28 return j; 29 } 30 31 return null; 32 } 33 34 </script> 35 </head> 36 <body onload="boom();"></body> 37 </html>