docshell/base/crashtests/1584467.html


1
2
3
4
5
6
7
8
9
10
11
12

<script>
window.onload = () => {
  a.addEventListener("DOMSubtreeModified", () => {
    document.body.appendChild(b)
    document.body.removeChild(b)
    window[1]
  })
  a.type = ""
}
</script>
<embed id="a">
<iframe id="b"></iframe>