gecko/layout/reftests/bugs/212563-1-inner.html
2008-09-16 04:09:41 -07:00

4 lines
355 B
HTML

<frameset resizable="yes" rows="100%" onload="top.p(1);">
<frame src="data:text/html,<body onload=%22top.p(0); var t = top; var d = parent.document; d.write('<body onload=top.p(5);parent.document.documentElement.removeAttribute(\'class\');>foo<script>top.p(2);</script>'); t.p(3); t.p(d.documentElement.innerHTML); d.close(); t.p(4); %22>">
</frameset>