gecko-dev/dom/base/crashtests/695867.html

10 строки
198 B
HTML

<!DOCTYPE html>
<script>
var nodeList = document.documentElement.childNodes;
nodeList.__proto__ = null;
var p = Proxy.create({getPropertyDescriptor: function() {return nodeList}});
p.x;
</script>