dom/base/crashtests/1251361.html

   1 <!DOCTYPE html>
   2 <html>
   3 <head>
   4 <meta charset="UTF-8">
   5 <script>
   6
   7 var frameRoot;
   8
   9 function boom()
  10 {
  11     var frameWin = f.contentWindow;
  12     frameRoot = frameWin.document.documentElement;
  13     frameWin.location.replace("data:text/html;charset=UTF-8,<body onload='parent.g();'>2");
  14 }
  15
  16 function g()
  17 {
  18     setTimeout(h, 0);
  19 }
  20
  21 function h()
  22 {
  23     var newDoc = document.implementation.createDocument('', '', null);
  24     newDoc.adoptNode(frameRoot);
  25 }
  26
  27 </script>
  28 <body onload="boom();">
  29
  30 <iframe id="f" src="data:text/html;charset=UTF-8,<marquee>1"></iframe>
  31
  32 </body>
  33 </html>