tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

attr-crash.html (489B)

      1 <!DOCTYPE html>
      2 <title>CSS Values and Units Test: attr</title>
      3 <meta name="assert" content="Test attr use after free crash">
      4 <link rel="help" href="https://crbug.com/365802556">
      5 <head>
      6    <style>
      7        #div {
      8            --prop: attr(data-foo type(<ident>));
      9        }
     10    </style>
     11 </head>
     12 <body>
     13    <div id="div" data-foo="aaa123\aaa123aaa">Content</div>
     14 </body>
     15 <script>
     16    var elem = document.getElementById("div");
     17    getComputedStyle(elem).getPropertyValue("--prop");
     18 </script>