Blame layout/base/crashtests/1409147.html

Packit f0b94e
<style>
Packit f0b94e
#htmlvar00008 { background-blend-mode: screen, normal; }
Packit f0b94e
#htmlvar00009 { mix-blend-mode: darken; }
Packit f0b94e
.class1 {
Packit f0b94e
  outline: auto;
Packit f0b94e
  will-change: z-index;
Packit f0b94e
  background-image: url(data:image/gif;base64,R0lGODlhEAAQAMQAAORHHOVSKudfOulrSOp3WOyDZu6QdvCchPGolfO0o/XBs/fNwfjZ0frl3/zy7////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAkAABAALAAAAAAQABAAAAVVICSOZGlCQAosJ6mu7fiyZeKqNKToQGDsM8hBADgUXoGAiqhSvp5QAnQKGIgUhwFUYLCVDFCrKUE1lBavAViFIDlTImbKC5Gm2hB0SlBCBMQiB0UjIQA7);
Packit f0b94e
}
Packit f0b94e
</style>
Packit f0b94e
<script>
Packit f0b94e
function jsfuzzer() {
Packit f0b94e
  try { htmlvar00010.after(htmlvar00005); } catch(e) { }
Packit f0b94e
}
Packit f0b94e
</script>
Packit f0b94e
<body onload=jsfuzzer()>
Packit f0b94e

Packit f0b94e
Packit f0b94e
class="class1">
Packit f0b94e
<button id="htmlvar00009"></button>
Packit f0b94e
<canvas id="htmlvar00010">