Content - 6a54595e791ce5fcc0363752cf42480581248d3e - 90286bd/487539-1.html

487539-1.html
<!DOCTYPE html>
<html class="reftest-wait">
<head>
<script type="text/javascript">

var img = document.createElement("img");
img.setAttributeNS(null, "usemap", "#map");
img.setAttributeNS(null, "src", "data:image/gif;base64,R0lGODlhEwATAKIAAP//AMzMADMzAP8AAAAAAP///wAAAAAAACH5BAEAAAUALAAAAAATABMAAANWWLrUTisyEoC1oUlFr8dQRHykFRad+Y0gdzlv86KVKdsskOUAjHu312rFK5FuxaMNIMgYe85GrVfKZVDAR7DHmVoG4IHn6vqEgZLU90xOq8OazUS7SQAAOw==");

function boom()
{
  map = document.createElement("map");
  map.setAttributeNS(null, "name", "map");
  area = document.createElement("area");
  map.appendChild(area);
  span = document.createElement("span");
  span.appendChild(img);
  td = document.createElement("td");
  span.appendChild(td);
  map.appendChild(span);
  document.body.appendChild(map);
  boom2();
}

function boom2()
{
  // For reliable reproduction, need a flush here.
  var x = document.body.offsetWidth;

  // needs to be async, apparently.
  setTimeout(boom3, 0);
}

function boom3()
{
  span.parentNode.removeChild(span); 
  document.documentElement.removeAttribute("class");
}

</script>
</head>

<body onload="boom();"></body>

</html>