1 files changed, 31 insertions, 0 deletions
diff --git a/js/xpconnect/tests/mochitest/file_bug650273.html b/js/xpconnect/tests/mochitest/file_bug650273.html
new file mode 100644
index 000000000..5fe33e969
--- /dev/null
+++ b/js/xpconnect/tests/mochitest/file_bug650273.html
@@ -0,0 +1,31 @@
+<!-- test by moz_bug_r_a4@yahoo.com -->
+<body onload="a()">
+<script>
+var targetUrl = "http://example.com/";
+var l;
+
+function a() {
+        var o = {};
+        o.toString = function() {
+                l();
+                return "a";
+        };
+        var f = Object.getOwnPropertyDescriptor(Document.prototype, "title").set;
+        setTimeout(f.bind(document), 0, o);
+}
+
+function l() {
+        var l = false;
+        onunload = function() {
+                l = true;
+        };
+        location = targetUrl;
+        do {
+                var r = new XMLHttpRequest();
+                r.open("GET", location.href, false);
+                r.overrideMimeType("text/plain");
+                try { r.send(null); }
+                catch (e) {}
+        } while (!l);
+}
+</script>