tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

implicit-parent-insertion-crash.html (327B)

      1 <!DOCTYPE html>
      2 <body>
      3 <title>Use-after-free when inserting implicit parent selector</title>
      4 <link rel="help" href="https://crbug.com/1380313">
      5 <style>
      6 :root {
      7  :lang(en), :lang(en) {
      8  }
      9 }
     10 </style>
     11 <div lang="en"></div>
     12 <script>
     13  // Allocate a large chunk of memory, to trigger a GC.
     14  new Int32Array(536870911);
     15 </script>