gecko/js/xpconnect/crashtests/468552-1.html

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script type="text/javascript">

function boom()
{
  var dp = document.__proto__;
  dp.__proto__ = new XPCNativeWrapper(new XMLSerializer);
  try {
    dp.replaceChild();
  } catch(e) { }
}

</script>
</head>

<body onload="boom();"></body>
</html>
Add 19 crashtests 2009-01-01 14:18:58 -08:00			`<html xmlns="http://www.w3.org/1999/xhtml">`
			`<head>`
			`<script type="text/javascript">`

			`function boom()`
			`{`
			`var dp = document.__proto__;`
			`dp.__proto__ = new XPCNativeWrapper(new XMLSerializer);`
			`try {`
Bug 801562 - Remove Node.isSupported; r=bz --HG-- rename : content/svg/content/test/test_isSupported.xhtml => content/svg/content/test/test_hasFeature.xhtml 2013-03-15 03:21:52 -07:00			`dp.replaceChild();`
Add 19 crashtests 2009-01-01 14:18:58 -08:00			`} catch(e) { }`
			`}`

			`</script>`
			`</head>`

			`<body onload="boom();"></body>`
			`</html>`