Source code
Revision control
Copy as Markdown
Other Tools
Test Info:
- This WPT test may be referenced by the following Test IDs:
- /html/syntax/parsing/crashtests/adoption-agency-002.html - WPT Dashboard Interop Dashboard
<!DOCTYPE html>
<html>
<meta charset="utf-8">
<title>Adoption Agency Algorithm UAF</title>
<link rel="help" href="https://html.spec.whatwg.org/multipage/parsing.html#adoption-agency-algorithm">
<iframe id="ifr"></iframe>
<script>
let ifr = document.getElementById('ifr');
let ifrWin = ifr.contentWindow;
class XFoo extends ifrWin.HTMLElement {
constructor() {
super();
let s = "";
for (let i = 0; i < 1000; i++) {
s += `<b class="c${i}">`;
}
document.write(s);
}
}
ifrWin.customElements.define("x-foo", XFoo, { extends: "b" });
document.write('<b is="x-foo" id="fmt"><div id="block"><script>' +
'let b = document.getElementById("block");' +
'let i = document.getElementById("ifr");' +
'i.contentDocument.adoptNode(b);' +
'<\/script></b>');
</script>