mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-11-01 06:35:42 +00:00
22 lines
437 B
HTML
22 lines
437 B
HTML
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<script>
|
|
|
|
function boom()
|
|
{
|
|
var frameDoc = document.getElementById("f").contentDocument;
|
|
|
|
var confusedNode = frameDoc.createTextNode("y");
|
|
confusedNode.__proto__ = document.createTextNode("x");
|
|
confusedNode.setUserData("key", "data", null);
|
|
confusedNode.setUserData("key", "data", null);
|
|
}
|
|
|
|
</script>
|
|
</head>
|
|
<body onload="boom();">
|
|
<iframe src="data:text/html,1" id="f"></iframe>
|
|
</body>
|
|
</html>
|