blob: 321b2010887f951b44b1fe09fbc3f0646b7a41fa (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
|
<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
xmlns:html="http://www.w3.org/1999/xhtml"
class="reftest-wait"
title="Testcase bug 325218 - Crash with evil xul testcase, using box, tooltip, object, etc">
<html:span>
<box>
<tooltip/>
</box>
<html:td/><html:object style="display: none;">This should not crash Mozilla
<html:span style="display: table;"/>
</html:object>
</html:span>
<html:script>
function doe(){
document.getElementsByTagName('html:object')[0].removeAttribute('style');
document.getElementsByTagName('html:object')[0].offsetHeight;
document.getElementsByTagName('html:span')[1].removeAttribute('style');
document.getElementsByTagName('html:object')[0].setAttribute('style', 'text-decoration: underline');
document.documentElement.removeAttribute("class");
}
setTimeout(doe,50);
</html:script>
</window>
|
