Source code
Revision control
Copy as Markdown
Other Tools
Test Info:
- This WPT test may be referenced by the following Test IDs:
- /html/syntax/parsing/crashtests/adoption-agency-bailout-001.html - WPT Dashboard Interop Dashboard
<!DOCTYPE html>
<html>
<meta charset="utf-8">
<title>Out-of-bounds access in the adoption agency algorithm bailout</title>
<iframe id="ifr"></iframe>
<script>
let ifr = document.getElementById('ifr');
let ifrWin = ifr.contentWindow;
class XFoo extends ifrWin.HTMLElement {
constructor() {
super();
if (window.didReenter) return;
window.didReenter = true;
// Close earlier tags to shrink the active formatting elements list
document.write('</b2></b1></b0>');
}
}
ifrWin.customElements.define("x-foo", XFoo, { extends: "b" });
document.write('<b id="b0"><b id="b1"><b id="b2"><b id="fmt"><div><div><div><b is="x-foo"><p></b>');
</script>