bug 371124 - crash tests by Martijn Wargers, Mats Palmgren.

This commit is contained in:
Bob Clary 2009-04-24 10:08:17 -07:00
parent 0b5c6196e1
commit e8185d5535
5 changed files with 51 additions and 0 deletions

View File

@ -0,0 +1,21 @@
<html>
<head>
<script>
function boom()
{
obj = document.getElementsByTagName("object")[0];
obj.__proto__ = null;
for (p in obj)
dump(p + "\n");
}
</script>
</head>
<body onload="setTimeout(boom, 200);">
<object></object>
</body>
</html>

View File

@ -0,0 +1,9 @@
<html class="reftest-wait">
<head>
<script>
setTimeout('document.documentElement.className = ""', 500);
</script>
<body>
<iframe src="371124-1-inner.html"></iframe>
</body>
</html>

View File

@ -0,0 +1,10 @@
<html>
<body>
<script>
document.all.tags.__proto__ = null;
alert(document.all.tags)
</script>
</body>
</html>

View File

@ -0,0 +1,9 @@
<html class="reftest-wait">
<head>
<script>
setTimeout('document.documentElement.className = ""', 500);
</script>
<body>
<iframe src="371124-2-inner.html"></iframe>
</body>
</html>

View File

@ -8,6 +8,8 @@ load 338674-1.xhtml
load 346381-1.html
load 359432-1.xhtml
load 369413-1.html
load 371124-1.html
load 371124-2.html
load 372554-1.html
load 404869-1.xul
load 462947.html