js/xpconnect/crashtests/751995.html

   1 <!DOCTYPE html>
   2 <html class="reftest-wait">
   3 <head>
   4 <script>
   5
   6 function frameDoc() { return document.getElementById("f").contentDocument; }
   7
   8 function arm() {
   9   // Create an element in the iframe.
  10   var div = frameDoc().createElement("div");
  11
  12   // Force a wrapper to be created for .style.
  13   var style = div.style;
  14   style.color = "green";
  15
  16   // Adopt the element out of the iframe, leaving the |style| behind.
  17   document.adoptNode(div);
  18 }
  19
  20 function boom()
  21 {
  22   // Create an orphan.
  23   arm();
  24
  25   // Force an iteration over all the wrappers in frameDoc's scope, causing
  26   // us to notice the orphan.
  27   frameDoc().write("2");
  28
  29   // All done.
  30   document.documentElement.removeAttribute("class");
  31 }
  32
  33 </script>
  34 </head>
  35 <body onload="boom();"><iframe id="f" srcdoc="1"></iframe></body>
  36 </html>