tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

ruby-dynamic-removal-004-crash.html (632B)

      1 <!doctype html>
      2 <link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1902540">
      3 <script>
      4 let fuzz = () => {
      5  document.body.appendChild(document.createElement("iframe"))
      6  document.getElementById("b").appendChild(document.createElement("plaintext"))
      7  document.documentElement.offsetHeight;
      8  window.frames[0].document.body.appendChild(document.getElementById("a"))
      9  window.frames[0].document.body.appendChild(document.getElementById("c"))
     10 }
     11 </script>
     12 <style>
     13 :last-child {
     14  display: ruby-text-container;
     15 }
     16 </style>
     17 <body onload="fuzz()">
     18 <fieldset id="a"></fieldset>
     19 <ruby id="b">
     20 <ul id="c"></ul>
     21 </ruby>
     22 </body>