blob: 4be1e1c8f9ed31c386c70bd8744219346ef4637e (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
|
<!DOCTYPE html>
<body>
<title>Use-after-free when inserting implicit parent selector</title>
<link rel="help" href="https://crbug.com/1380313">
<style>
:root {
:lang(en), :lang(en) {
}
}
</style>
<div lang="en"></div>
<script>
// Allocate a large chunk of memory, to trigger a GC.
new Int32Array(536870911);
</script>
|
