blob: f2f9bb352a51da59af2425bb5c36dc1c3d5d0986 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
|
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
onload="document.getElementById('trigger');">
<box style="display: none">
<bindings xmlns="http://www.mozilla.org/xbl">
<binding id="crash">
<implementation>
<constructor>
// Fetch it
var obj = this.getElementsByTagName("box")[0];
// And make it preserve its wrapper. Note that this will happen
// while we're wrapping our box as the parent for id="trigger",
// so then we'll unwind and things will be bad.
if (obj) obj.expando = 5;
</constructor>
</implementation>
</binding>
</bindings>
<box style="-moz-binding:url(#crash);">
<box id="trigger"/>
</box>
</box>
<!-- Make sure we load our XBL before we try to run our test -->
<box style="-moz-binding:url(#crash);"/>
</window>
|
