|
><bdi id=test1><refa id=test2>嵐>></bdi>><h1 id=test3><script>
|
|
document.addEventListener("DOMContentLoaded", CFcrash);
|
|
function CFcrash() {
|
|
test1.setAttribute("dir", "invalid");
|
|
test2.textContent = " S ";
|
|
test3.appendChild(test1);
|
|
}</script>
|