mirror of
https://gitlab.winehq.org/wine/wine-gecko.git
synced 2024-09-13 09:24:08 -07:00
bug 382568 - crash test by Vlad Sukhoy.
This commit is contained in:
parent
c85ca80f23
commit
8e9d3f6710
52
content/html/content/crashtests/382568-1-inner.xhtml
Normal file
52
content/html/content/crashtests/382568-1-inner.xhtml
Normal file
@ -0,0 +1,52 @@
|
||||
<?xml version="1.0"?>
|
||||
<!DOCTYPE html
|
||||
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
|
||||
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml"> <head>
|
||||
<title>Test</title>
|
||||
<script type="text/javascript"><![CDATA[
|
||||
|
||||
function onAttrModified(evt) {
|
||||
// window.alert("Mutation event fired within the frame code.");
|
||||
// evt.target.focus();
|
||||
// evt.target.blur();
|
||||
evt.target.style.background = 'green';
|
||||
bounce(evt.target);
|
||||
// evt.target.normalize();
|
||||
// bounce(evt.target.parentNode);
|
||||
}
|
||||
function die(n) {
|
||||
p = n.parentNode;
|
||||
p.removeChild(n);
|
||||
}
|
||||
|
||||
function bounce(n) {
|
||||
p = n.parentNode;
|
||||
p.removeChild(n);
|
||||
p.appendChild(n);
|
||||
}
|
||||
|
||||
|
||||
function test_AttrModified() {
|
||||
var x = document.getElementById("x");
|
||||
x.addEventListener("DOMAttrModified", onAttrModified, false);
|
||||
bounce(x);
|
||||
}
|
||||
|
||||
function test() {
|
||||
setTimeout(test_AttrModified, 3000);
|
||||
}
|
||||
]]></script>
|
||||
</head>
|
||||
|
||||
<body onload="test()">
|
||||
<h1>TestCase for unsafe mutable events from textarea</h1>
|
||||
<p>Please wait for 3 seconds after document was loaded,
|
||||
if your browser is vulnerable, it may stop responding
|
||||
to keyboard and mouse event
|
||||
and most likely it will eventually crash (may take a
|
||||
while for debug builds).</p>
|
||||
<p>
|
||||
<textarea id="x"></textarea>
|
||||
</p>
|
||||
</body> </html>
|
9
content/html/content/crashtests/382568-1.html
Normal file
9
content/html/content/crashtests/382568-1.html
Normal file
@ -0,0 +1,9 @@
|
||||
<html class="reftest-wait">
|
||||
<head>
|
||||
<script>
|
||||
setTimeout('document.documentElement.className = ""', 3500);
|
||||
</script>
|
||||
<body>
|
||||
<iframe src="382568-1-inner.xhtml"></iframe>
|
||||
</body>
|
||||
</html>
|
@ -5,6 +5,7 @@ load 324918-1.xhtml
|
||||
load 338649-1.xhtml
|
||||
load 339501-1.xhtml
|
||||
load 339501-2.xhtml
|
||||
load 382568-1.html
|
||||
load 423371-1.html
|
||||
load 451123-1.html
|
||||
load 453406-1.html
|
||||
|
Loading…
Reference in New Issue
Block a user