summaryrefslogtreecommitdiffstats
path: root/layout/base/crashtests/379105-1.xhtml
diff options
context:
space:
mode:
Diffstat (limited to 'layout/base/crashtests/379105-1.xhtml')
-rw-r--r--layout/base/crashtests/379105-1.xhtml48
1 files changed, 48 insertions, 0 deletions
diff --git a/layout/base/crashtests/379105-1.xhtml b/layout/base/crashtests/379105-1.xhtml
new file mode 100644
index 000000000..e20cced16
--- /dev/null
+++ b/layout/base/crashtests/379105-1.xhtml
@@ -0,0 +1,48 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<bindings xmlns="http://www.mozilla.org/xbl">
+
+<binding id="x"><content>
+ <zzz><children/></zzz>
+</content></binding>
+
+<binding id="empty"><content>
+</content></binding>
+
+</bindings>
+
+<script>
+<![CDATA[
+
+var xbltarget;
+
+function boom1()
+{
+ xbltarget = document.getElementById("xbltarget");
+ xbltarget.style.MozBinding = "url('#x')";
+ setTimeout(boom2, 0);
+}
+
+function boom2()
+{
+ var nodes = SpecialPowers.unwrap(SpecialPowers.wrap(document).getAnonymousNodes(xbltarget));
+ if (!nodes) {
+ setTimeout(boom2, 10);
+ return;
+ }
+ var anox = nodes[0];
+ var frame = document.createElementNS("http://www.w3.org/1999/xhtml", "frame")
+ frame.src = "data:text/html,<html><body>Hi!</body></html>";
+ anox.appendChild(frame);
+ xbltarget.style.MozBinding = "url('#empty')";
+
+ document.documentElement.removeAttribute("class");
+}
+
+]]>
+</script>
+</head>
+<body onload="boom1()">
+<div id="xbltarget"></div>
+</body>
+</html>