зеркало из https://github.com/mozilla/gecko-dev.git
38 строки
590 B
HTML
38 строки
590 B
HTML
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<script type="text/javascript">
|
|
|
|
function boom()
|
|
{
|
|
var a = [];
|
|
a[31] = undefined;
|
|
a[40] = undefined;
|
|
a[44] = {};
|
|
a[45] = new XMLHttpRequest();
|
|
a[48] = new XMLHttpRequest();
|
|
a[53] = XMLHttpRequest.prototype;
|
|
a[53].__proto__ = {};
|
|
a[53].nodeType = 100;
|
|
search(a, 41);
|
|
}
|
|
|
|
|
|
function search(a, start)
|
|
{
|
|
var N = a.length;
|
|
|
|
for (var j = start; j < N; ++j) {
|
|
var e = a[j];
|
|
if (typeof e == "object" && "nodeType" in e && e.nodeType == 99)
|
|
return j;
|
|
}
|
|
|
|
return null;
|
|
}
|
|
|
|
</script>
|
|
</head>
|
|
<body onload="boom();"></body>
|
|
</html>
|