gecko-dev/dom/bindings/crashtests/1010658-2.html

<!DOCTYPE html>
<html>
<head>
<script>
function boom()
{
    window.__proto__ = function(){};
    for (var i = 0; i < 10000; ++i) {
        self.document;
    }
}

</script></head>

<body onload="boom();"></body>
</html>
Bug 1010658 part 1. Stop using the DOMClass stored in DOM_PROTO_INSTANCE_CLASS_SLOT for doing type checks in the jit, and do them directly on the instance classes instead. r=efaust 2014-05-20 00:37:59 +04:00			`<!DOCTYPE html>`
			`<html>`
			`<head>`
			`<script>`
			`function boom()`
			`{`
			`window.__proto__ = function(){};`
			`for (var i = 0; i < 10000; ++i) {`
			`self.document;`
			`}`
			`}`

			`</script></head>`

			`<body onload="boom();"></body>`
			`</html>`