tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

344000-1.html (904B)


      1 <html xmlns="http://www.w3.org/1999/xhtml">
      2 <head>
      3    <title>dom cellmap crash</title>
      4 
      5 
      6 
      7 <script>
      8 function doit()
      9 {
     10  var doc = window.document;
     11  var t1= doc.getElementById('table1');
     12  var tbA =  doc.createElement('tbody');
     13  t1.appendChild(tbA);
     14  var trA = doc.createElement('tr');
     15  var td = doc.createElement('td');
     16  td.setAttribute('rowspan', 2);
     17  trA.appendChild(td);
     18  tbA.appendChild(trA);
     19  var trB = doc.createElement('tr');
     20  var tdB = doc.createElement('td');
     21  tdB.setAttribute('rowspan', 2);
     22  trB.appendChild(tdB);
     23  tbA.appendChild(trB);
     24  tdB.remove();
     25  trA.remove();
     26  trB.remove();
     27  var tb =  doc.createElement('tbody');
     28  trB.appendChild(tdB);
     29  tb.appendChild(trB);
     30  t1.appendChild(tb);
     31 }
     32 </script>
     33 
     34 </head>
     35 
     36 <body onload="doit()">
     37 
     38 <table id="table1"><tbody id="tbody1"><tr id="tr1"><td id="td1">x</td></tr></tbody></table>
     39 
     40 
     41 
     42 
     43 </body>
     44 
     45 </html>