mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-10-21 09:15:35 +00:00
f31f7f7cc6
nsDOMAttributeMap::BlastSubtreeToPieces() uses a hash table iterator to get an arbitrary element from a hash table. This marks the hash table as being in use. It then modifies the hash table before the iterator is destroyed, triggering an assertion. The fix is to restrict the scope of the iterator so that it is destroyed before the hashtable is modified. The existing code is safe because the iterator is never used after the hash table has been modified. MozReview-Commit-ID: DUjqewvwEe7 --HG-- extra : rebase_source : 698046af75890c8f52ba15331115b9ff119c689a
19 lines
678 B
HTML
19 lines
678 B
HTML
<script>
|
|
function fzfn(e){
|
|
let nc=window.frames[0].document.body.childElementCount;
|
|
let o=window.frames[0].document.body.childNodes[1%nc];
|
|
document.getElementById('b').appendChild(o.parentNode.removeChild(o));
|
|
}
|
|
window.onload=function(){
|
|
document.body.onerror=fzfn;
|
|
document.getElementById('c').addEventListener('DOMNodeRemoved', fzfn, true);
|
|
document.getElementById('c').attributes[0].name=='id';
|
|
window.frames[0].document.body.appendChild(document.getElementById('c'));
|
|
document.getElementById('a').innerHTML=document.createElement('multicol').outerHTML;
|
|
}
|
|
</script>
|
|
<iframe></iframe>
|
|
<script id='a'></script>
|
|
<script id='b'></script>
|
|
<script id='c'></script>
|