summaryrefslogtreecommitdiffstats
path: root/dom/html/crashtests/382568-1-inner.xhtml
diff options
context:
space:
mode:
Diffstat (limited to 'dom/html/crashtests/382568-1-inner.xhtml')
-rw-r--r--dom/html/crashtests/382568-1-inner.xhtml52
1 files changed, 52 insertions, 0 deletions
diff --git a/dom/html/crashtests/382568-1-inner.xhtml b/dom/html/crashtests/382568-1-inner.xhtml
new file mode 100644
index 000000000..a3685f4c6
--- /dev/null
+++ b/dom/html/crashtests/382568-1-inner.xhtml
@@ -0,0 +1,52 @@
+<?xml version="1.0"?>
+<!DOCTYPE html
+PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml"> <head>
+<title>Test</title>
+<script type="text/javascript"><![CDATA[
+
+function onAttrModified(evt) {
+// window.alert("Mutation event fired within the frame code.");
+// evt.target.focus();
+// evt.target.blur();
+ evt.target.style.background = 'green';
+ bounce(evt.target);
+// evt.target.normalize();
+// bounce(evt.target.parentNode);
+}
+function die(n) {
+ p = n.parentNode;
+ p.removeChild(n);
+}
+
+function bounce(n) {
+ p = n.parentNode;
+ p.removeChild(n);
+ p.appendChild(n);
+}
+
+
+function test_AttrModified() {
+ var x = document.getElementById("x");
+ x.addEventListener("DOMAttrModified", onAttrModified, false);
+ bounce(x);
+}
+
+function test() {
+ setTimeout(test_AttrModified, 3000);
+}
+]]></script>
+</head>
+
+<body onload="test()">
+<h1>TestCase for unsafe mutable events from textarea</h1>
+<p>Please wait for 3 seconds after document was loaded,
+if your browser is vulnerable, it may stop responding
+to keyboard and mouse event
+and most likely it will eventually crash (may take a
+while for debug builds).</p>
+<p>
+<textarea id="x"></textarea>
+</p>
+</body> </html>