blob: dea15642c79a20cbae5c87d205581d4c73313d45 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
|
<!DOCTYPE HTML>
<html>
<head>
<title>FontFaceSet::Load crasher</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<style type="text/css">
body {
margin: 50px;
}
p {
margin: 0;
font-size: 300%;
}
</style>
</head>
<body>
<p>This may crash on load...</p>
<script>
var scriptText = `
var fontFaceSet = document.fonts;
var link = document.createElement("link");
link.onerror = link.onload = function() {
fontFaceSet.load("12px foo");
}
link.rel = "stylesheet";
link.href = "data:text/css,";
document.body.appendChild(link);
`;
var styleText = `
@font-face {
font-family: foo;
src: url("data:text/ttf,");
}
`;
var ifr = document.createElement("iframe");
document.body.appendChild(ifr);
var style = ifr.contentDocument.createElement("style");
style.textContent = styleText;
ifr.contentDocument.body.appendChild(style);
var script = ifr.contentDocument.createElement("script");
script.textContent = scriptText;
ifr.contentDocument.body.appendChild(script);
ifr.remove();
</script>
</body>
</html>
|
