source-git / mozjs60

Clone
Source Code
GIT

Blame layout/generic/crashtests/309322-2.html

c8 master
  1.   c8
  2.   layout
  3.   generic
  4.   crashtests
  5.   309322-2.html
Blob History Raw
Packit f0b94e 
<html><head>
Packit f0b94e 
<title>Testcase2 bug 309322 - Evil testcase using multiple display:table-caption causes crash</title>
Packit f0b94e 
<style>
Packit f0b94e 
*[toggle_style],*[toggle_style1],*[toggle_style2],*[toggle_style3],*[toggle_style4]{
Packit f0b94e 
display:table-caption;
Packit f0b94e 
}
Packit f0b94e 
</style>
Packit f0b94e 
<script>
Packit f0b94e 
function doe(i){
Packit f0b94e 
var x=document.body.getElementsByTagName('*');
Packit f0b94e 
var xl=x.length;i=i+1;
Packit f0b94e 
x[i-1].removeAttribute('toggle_style');
Packit f0b94e 
if ((i)
Packit f0b94e 
if ((i+1)
Packit f0b94e 
x[i].removeAttribute('toggle_style1');
Packit f0b94e 
}
Packit f0b94e 
if ((i+2)
Packit f0b94e 
x[i+1].removeAttribute('toggle_style2');
Packit f0b94e 
}
Packit f0b94e 
if ((i+3)
Packit f0b94e 
x[i+2].removeAttribute('toggle_style3');
Packit f0b94e 
}
Packit f0b94e 
if ((i+4)
Packit f0b94e 
x[i+3].removeAttribute('toggle_style4');
Packit f0b94e 
}
Packit f0b94e 
if ((i+4)==xl) {
Packit f0b94e 
x[i+3].removeAttribute('toggle_style4');
Packit f0b94e 
}
Packit f0b94e 
if ((i+3)==xl) {
Packit f0b94e 
x[i+2].removeAttribute('toggle_style3');
Packit f0b94e 
}
Packit f0b94e 
if ((i+2)==xl) {
Packit f0b94e 
x[i+1].removeAttribute('toggle_style2');
Packit f0b94e 
}
Packit f0b94e 
if ((i+1)==xl) {
Packit f0b94e 
x[i].removeAttribute('toggle_style1');
Packit f0b94e 
}
Packit f0b94e 
setTimeout(doe,20,i);
Packit f0b94e 
}
Packit f0b94e
Packit f0b94e 
function doe2(){
Packit f0b94e 
var x=document.links[0].cloneNode(true);
Packit f0b94e 
document.links[0].appendChild(x);
Packit f0b94e 
}
Packit f0b94e 
</script>
Packit f0b94e 
</head>
Packit f0b94e 
<body onload="doe(1)">
Packit f0b94e 
<button onclick="doe(1)">Clicking on this button should not crash Mozilla</button>
Packit f0b94e
Packit f0b94e
Packit f0b94e

Packit f0b94e 
GallowayGallowayGallowayGallowayGallowayGallowayGallowayGallowayGallowayGallowayGallowayGallowayGallowayGallowayGallowayGallowayGallowayGallowayGalloway
Packit f0b94e
Packit f0b94e
Packit f0b94e
Packit f0b94e 
</body></html>

Powered by Pagure 5.14.1

SSH Hostkey/Fingerprint | Documentation