bug 382568 - crash test by Vlad Sukhoy.

This commit is contained in:
Bob Clary 2009-04-24 10:08:19 -07:00
parent c85ca80f23
commit 8e9d3f6710
3 changed files with 62 additions and 0 deletions

View File

@ -0,0 +1,52 @@
<?xml version="1.0"?>
<!DOCTYPE html
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"> <head>
<title>Test</title>
<script type="text/javascript"><![CDATA[
function onAttrModified(evt) {
// window.alert("Mutation event fired within the frame code.");
// evt.target.focus();
// evt.target.blur();
evt.target.style.background = 'green';
bounce(evt.target);
// evt.target.normalize();
// bounce(evt.target.parentNode);
}
function die(n) {
p = n.parentNode;
p.removeChild(n);
}
function bounce(n) {
p = n.parentNode;
p.removeChild(n);
p.appendChild(n);
}
function test_AttrModified() {
var x = document.getElementById("x");
x.addEventListener("DOMAttrModified", onAttrModified, false);
bounce(x);
}
function test() {
setTimeout(test_AttrModified, 3000);
}
]]></script>
</head>
<body onload="test()">
<h1>TestCase for unsafe mutable events from textarea</h1>
<p>Please wait for 3 seconds after document was loaded,
if your browser is vulnerable, it may stop responding
to keyboard and mouse event
and most likely it will eventually crash (may take a
while for debug builds).</p>
<p>
<textarea id="x"></textarea>
</p>
</body> </html>

View File

@ -0,0 +1,9 @@
<html class="reftest-wait">
<head>
<script>
setTimeout('document.documentElement.className = ""', 3500);
</script>
<body>
<iframe src="382568-1-inner.xhtml"></iframe>
</body>
</html>

View File

@ -5,6 +5,7 @@ load 324918-1.xhtml
load 338649-1.xhtml
load 339501-1.xhtml
load 339501-2.xhtml
load 382568-1.html
load 423371-1.html
load 451123-1.html
load 453406-1.html