| <html> | |
| <body> | |
| <script> | |
| var script = document.getElementsByTagName("script")[0]; | |
| script.parentNode.removeChild(script); | |
| var count = 0; | |
| function crash() { | |
| var element = event.srcElement; | |
| document.adoptNode(element); | |
| if (!document.body.innerHTML) | |
| return; | |
| document.execCommand('InsertHTML', false, document.body.innerHTML); | |
| if (count == 1) { | |
| document.removeEventListener("DOMNodeInserted", crash, false); | |
| document.body.innerHTML = "PASS"; | |
| return; | |
| } | |
| count += 1; | |
| document.body.appendChild(element); | |
| element.insertAdjacentHTML('beforeend', '<svg><foreignObject>A</foreignObject></svg>'); | |
| element.focus(); | |
| } | |
| document.addEventListener("DOMNodeInserted", crash, false); | |
| document.addEventListener("DOMContentLoaded", function () { | |
| document.execCommand("SelectAll", false, false); | |
| var range = window.getSelection().getRangeAt(0); | |
| var docFragment = range.extractContents(); | |
| document.documentElement.firstChild.appendChild(docFragment); | |
| }, false); | |
| </script> | |
| <input/> | |
| </body> | |
| </html> |