mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-10-29 21:25:35 +00:00
22 lines
437 B
HTML
22 lines
437 B
HTML
|
<!DOCTYPE html>
|
||
|
<html>
|
||
|
<head>
|
||
|
<script>
|
||
|
|
||
|
function boom()
|
||
|
{
|
||
|
var frameDoc = document.getElementById("f").contentDocument;
|
||
|
|
||
|
var confusedNode = frameDoc.createTextNode("y");
|
||
|
confusedNode.__proto__ = document.createTextNode("x");
|
||
|
confusedNode.setUserData("key", "data", null);
|
||
|
confusedNode.setUserData("key", "data", null);
|
||
|
}
|
||
|
|
||
|
</script>
|
||
|
</head>
|
||
|
<body onload="boom();">
|
||
|
<iframe src="data:text/html,1" id="f"></iframe>
|
||
|
</body>
|
||
|
</html>
|