1 files changed, 49 insertions, 0 deletions
diff --git a/image/test/crashtests/ownerdiscard.html b/image/test/crashtests/ownerdiscard.html
new file mode 100644
index 000000000..8d4a619fc
--- /dev/null
+++ b/image/test/crashtests/ownerdiscard.html
@@ -0,0 +1,49 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<body>
+  <div id=tCF0>
+    <img id=victim src=ie.png>
+    <iframe src=discardframe.htm></iframe>
+  </div>
+  <script>
+    const Ci = SpecialPowers.Ci;
+    const Cc = SpecialPowers.Cc;
+
+    function ImageDecoderObserverStub()
+    {
+      this.sizeAvailable = function sizeAvailable(aRequest)   {}
+      this.frameComplete = function frameComplete(aRequest)   {}
+      this.decodeComplete = function decodeComplete(aRequest) {}
+      this.loadComplete = function loadComplete(aRequest)     {}
+      this.frameUpdate = function frameUpdate(aRequest)       {}
+      this.discard = function discard(aRequest)               {}
+      this.isAnimated = function isAnimated(aRequest)         {}
+    }
+    var img = document.getElementById('victim');
+    var observer = new ImageDecoderObserverStub();
+    observer.discard = function() {
+      cleanupAndFinish();
+    }
+    observer = SpecialPowers.wrapCallbackObject(observer);
+    var gObserver = Cc["@mozilla.org/image/tools;1"].getService(Ci.imgITools)
+                                                    .createScriptedObserver(observer);
+    var imgLoadingContent =
+      SpecialPowers.wrap(img).QueryInterface(Ci.nsIImageLoadingContent);
+    imgLoadingContent.addObserver(gObserver);
+    function initCF() {
+      setTimeout(function() { document.adoptNode(tCF0); }, 0);
+    }
+    document.addEventListener("DOMContentLoaded", initCF, false);
+
+    function cleanupAndFinish() {
+      imgLoadingContent.removeObserver(gObserver);
+      setTimeout("document.documentElement.className = '';", 0);
+    }
+    function loadhandler() {
+      setTimeout("cleanupAndFinish();", 30000);
+    }
+    window.addEventListener("load", function() {
+      SpecialPowers.pushPrefEnv({"set":[["min_discard_timeout_ms", 1]]}, loadhandler)}, false);
+  </script>
+</body>
+</html>