Gingerbread MR1  |  2.3.7_r1
Html程序  |  21行  |  681 B 

<body onload="test()">
<script>
    function test()
    {
        var win = window.open("");
        var doc = win.document;
        var text = "<html><body><sc" + "ript src='data:text/javascript,'></scr" + "ipt></body></html>";
        doc.write(text);
    }
</script>

<p>This test verifies that document.writing into a newly-opened empty
window does not cause crashes or assertion failures, even if it
triggers subresource loads. If you have popup blocking enabled you can
click the button below to test. The test only works in Safari, because
it depends on behavior with resource identifiers, which are provided
by the app.</p>

<button onclick="test()">Crash</button>
</body>