487539-1.html (1114B)
1 <!DOCTYPE html> 2 <html class="reftest-wait"> 3 <head> 4 <script type="text/javascript"> 5 6 var img = document.createElement("img"); 7 img.setAttributeNS(null, "usemap", "#map"); 8 img.setAttributeNS(null, "src", "data:image/gif;base64,R0lGODlhEwATAKIAAP//AMzMADMzAP8AAAAAAP///wAAAAAAACH5BAEAAAUALAAAAAATABMAAANWWLrUTisyEoC1oUlFr8dQRHykFRad+Y0gdzlv86KVKdsskOUAjHu312rFK5FuxaMNIMgYe85GrVfKZVDAR7DHmVoG4IHn6vqEgZLU90xOq8OazUS7SQAAOw=="); 9 10 function boom() 11 { 12 map = document.createElement("map"); 13 map.setAttributeNS(null, "name", "map"); 14 area = document.createElement("area"); 15 map.appendChild(area); 16 span = document.createElement("span"); 17 span.appendChild(img); 18 td = document.createElement("td"); 19 span.appendChild(td); 20 map.appendChild(span); 21 document.body.appendChild(map); 22 boom2(); 23 } 24 25 function boom2() 26 { 27 // For reliable reproduction, need a flush here. 28 var x = document.body.offsetWidth; 29 30 // needs to be async, apparently. 31 setTimeout(boom3, 0); 32 } 33 34 function boom3() 35 { 36 span.remove(); 37 document.documentElement.removeAttribute("class"); 38 } 39 40 </script> 41 </head> 42 43 <body onload="boom();"></body> 44 45 </html>