mirror of
https://gitlab.winehq.org/wine/wine-gecko.git
synced 2024-09-13 09:24:08 -07:00
29dd20ec7d
This bug happens when we take the !useSandbox path. Basically, when the code throws, we can end up with garbage in *aRetValue while still returning true from EvaluateString. It looks like the convention is for these kind of eval functions to return success even for invalid code, so lets just make sure we check things a bit better. This crashtest is kind of half-baked in the sense that it doesn't actually crash without the rest of the patch. But the testcase here involves a lot of undefined behavior (what ends up getting left in *aRetValue) during a call to window.open (which spins the event loop, etc). I already sunk about half an hour into trying to make it crash, so I'm just going to go with this for now.
15 lines
259 B
HTML
15 lines
259 B
HTML
<!DOCTYPE html>
|
|
<html class="reftest-wait">
|
|
<head>
|
|
<script>
|
|
function go() {
|
|
window.location = "javascript: foopy();";
|
|
setTimeout(function(){document.documentElement.removeAttribute("class");}, 0);
|
|
}
|
|
|
|
</script>
|
|
</head>
|
|
<body onload="go()">
|
|
</body>
|
|
</html>
|