gecko-dev/js/xpconnect/crashtests/833856.html

<!DOCTYPE html>
<html class="reftest-wait">
<head>
<script>
function go() {
  window.location = "javascript: foopy();";
  setTimeout(function(){document.documentElement.removeAttribute("class");}, 0);
}

</script>
</head>
<body onload="go()">
</body>
</html>
Bug 833856 - Handle errors better in EvaluateString. r=bz This bug happens when we take the !useSandbox path. Basically, when the code throws, we can end up with garbage in aRetValue while still returning true from EvaluateString. It looks like the convention is for these kind of eval functions to return success even for invalid code, so lets just make sure we check things a bit better. This crashtest is kind of half-baked in the sense that it doesn't actually crash without the rest of the patch. But the testcase here involves a lot of undefined behavior (what ends up getting left in aRetValue) during a call to window.open (which spins the event loop, etc). I already sunk about half an hour into trying to make it crash, so I'm just going to go with this for now. 2013-01-25 10:17:40 +00:00			`<!DOCTYPE html>`
			`<html class="reftest-wait">`
			`<head>`
			`<script>`
			`function go() {`
			`window.location = "javascript: foopy();";`
			`setTimeout(function(){document.documentElement.removeAttribute("class");}, 0);`
			`}`

			`</script>`
			`</head>`
			`<body onload="go()">`
			`</body>`
			`</html>`