dom/base/crashtests/695867.html


1
2
3
4
5
6
7
8
9

<!DOCTYPE html>
<script>

var nodeList = document.documentElement.childNodes;
nodeList.__proto__ = null;
var p = new Proxy({}, {getOwnPropertyDescriptor: function() {return nodeList}});
Reflect.getOwnPropertyDescriptor(p, "x");

</script>