blob: 6a54595e791ce5fcc0363752cf42480581248d3e (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
|
<!DOCTYPE html>
<html class="reftest-wait">
<head>
<script type="text/javascript">
var img = document.createElement("img");
img.setAttributeNS(null, "usemap", "#map");
img.setAttributeNS(null, "src", "data:image/gif;base64,R0lGODlhEwATAKIAAP//AMzMADMzAP8AAAAAAP///wAAAAAAACH5BAEAAAUALAAAAAATABMAAANWWLrUTisyEoC1oUlFr8dQRHykFRad+Y0gdzlv86KVKdsskOUAjHu312rFK5FuxaMNIMgYe85GrVfKZVDAR7DHmVoG4IHn6vqEgZLU90xOq8OazUS7SQAAOw==");
function boom()
{
map = document.createElement("map");
map.setAttributeNS(null, "name", "map");
area = document.createElement("area");
map.appendChild(area);
span = document.createElement("span");
span.appendChild(img);
td = document.createElement("td");
span.appendChild(td);
map.appendChild(span);
document.body.appendChild(map);
boom2();
}
function boom2()
{
// For reliable reproduction, need a flush here.
var x = document.body.offsetWidth;
// needs to be async, apparently.
setTimeout(boom3, 0);
}
function boom3()
{
span.parentNode.removeChild(span);
document.documentElement.removeAttribute("class");
}
</script>
</head>
<body onload="boom();"></body>
</html>
|
