root-replace-crash.html (490B)
1 <html> 2 <head> 3 <script> 4 document.addEventListener("DOMContentLoaded", async () => { 5 const tt = document.createElementNS("http://www.w3.org/1999/xhtml", "tt") 6 tt.popover = "manual" 7 const viewTransition = document.startViewTransition(undefined) 8 await viewTransition.updateCallbackDone 9 for (let i = 0; i < 2; i++) { 10 document.replaceChild(tt, document.childNodes[(2324524876 % document.childNodes.length)]) 11 } 12 }) 13 </script> 14 <head> 15 </html>