dom/bindings/crashtests/862610.html

   1 <!DOCTYPE html>
   2 <html>
   3 <head>
   4 <meta charset="UTF-8">
   5 <script>
   6   HTMLElement.prototype.__proto__ = new Proxy({}, {});
   7   try {
   8     window.Image;
   9   } finally {
  10     // Restore our prototype so the test harnesses can deal with us
  11     // We can't just assign to __proto__ because it lives on our proto chain
  12     // and we messed that up.
  13     var desc = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__");
  14     desc.set.call(HTMLElement.prototype, Element.prototype);
  15   }
  16 </script>
  17 </head>
  18
  19 <body></body>
  20 </html>