summaryrefslogtreecommitdiffstats
path: root/dom/bindings/crashtests/862610.html
diff options
context:
space:
mode:
Diffstat (limited to 'dom/bindings/crashtests/862610.html')
-rw-r--r--dom/bindings/crashtests/862610.html20
1 files changed, 20 insertions, 0 deletions
diff --git a/dom/bindings/crashtests/862610.html b/dom/bindings/crashtests/862610.html
new file mode 100644
index 000000000..768871ad9
--- /dev/null
+++ b/dom/bindings/crashtests/862610.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+ HTMLElement.prototype.__proto__ = new Proxy({}, {});
+ try {
+ window.Image;
+ } finally {
+ // Restore our prototype so the test harnesses can deal with us
+ // We can't just assign to __proto__ because it lives on our proto chain
+ // and we messed that up.
+ var desc = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__");
+ desc.set.call(HTMLElement.prototype, Element.prototype);
+ }
+</script>
+</head>
+
+<body></body>
+</html>