<!DOCTYPE html> <html> <body onload="go()"> <svg id="outerSvg" width="50%" height="50%" style="border: 1px solid black"> </svg> <script type="application/javascript"> /* I'm not sure what exactly was required to trigger bug 1288228's crash, * but it involved tweaking a length's specified units and cycle-collecting * and reloading (in some combination). So, we'll tweak the units and * cycle-collect a few times, and message the outer page to reload us * after we've made the first tweak. */ const maxTweaks = 5; let remainingTweaks = maxTweaks; var savedBaseVal = document.getElementById("outerSvg").width.baseVal; function go() { window.parent.SpecialPowers.DOMWindowUtils.cycleCollect(); tweak(); } function tweak() { console.log("tweaked"); savedBaseVal.convertToSpecifiedUnits(SVGLength.SVG_LENGTHTYPE_PX); savedBaseVal.convertToSpecifiedUnits(SVGLength.SVG_LENGTHTYPE_PERCENTAGE); if (remainingTweaks == maxTweaks) { window.parent.postMessage("ping", "*"); // only do this on first tweak } if (--remainingTweaks) { setTimeout(tweak, 0); } } </script> </body> </html>