diff options
| author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-19 00:47:55 +0000 |
|---|---|---|
| committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-19 00:47:55 +0000 |
| commit | 26a029d407be480d791972afb5975cf62c9360a6 (patch) | |
| tree | f435a8308119effd964b339f76abb83a57c29483 /dom/svg/test/test_valueLeaks.xhtml | |
| parent | Initial commit. (diff) | |
| download | firefox-e51783d008170d9ab27d25da98ca3a38b0a41b67.tar.xz firefox-e51783d008170d9ab27d25da98ca3a38b0a41b67.zip | |
Adding upstream version 124.0.1.upstream/124.0.1
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'dom/svg/test/test_valueLeaks.xhtml')
| -rw-r--r-- | dom/svg/test/test_valueLeaks.xhtml | 84 |
1 files changed, 84 insertions, 0 deletions
diff --git a/dom/svg/test/test_valueLeaks.xhtml b/dom/svg/test/test_valueLeaks.xhtml new file mode 100644 index 0000000000..ce816efc1c --- /dev/null +++ b/dom/svg/test/test_valueLeaks.xhtml @@ -0,0 +1,84 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<!-- +https://bugzilla.mozilla.org/show_bug.cgi?id=467671 +--> +<head> + <title>Test for Bug 467671</title> + <script src="/tests/SimpleTest/SimpleTest.js"></script> + <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/> +</head> +<body> +<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=467671">Mozilla Bug 467671</a> +<p id="display"></p> +<div id="content" style="display: none"> + +</div> +<pre id="test"> +<script type="application/javascript"> +<![CDATA[ + +/** Test for Bug 467671 **/ + +function storeSVGPropertyAsExpando(localName, prop) { + var elem = document.createElementNS("http://www.w3.org/2000/svg", localName); + + elem.addEventListener("click", function() {}); + + var propVal = elem[prop]; + Object.prototype.valueOf[prop + "_expando"] = propVal; + if (propVal instanceof SVGAnimatedAngle || propVal instanceof SVGAnimatedLength || + propVal instanceof SVGAnimatedRect || propVal instanceof SVGAnimatedPreserveAspectRatio) { + Object.prototype.valueOf[prop + "_baseVal_expando"] = propVal.baseVal; + Object.prototype.valueOf[prop + "_animVal_expando"] = propVal.animVal; + } +} + +// class +storeSVGPropertyAsExpando("marker", "class"); + +// angle +storeSVGPropertyAsExpando("marker", "orientAngle"); + +// viewBox +storeSVGPropertyAsExpando("marker", "viewBox"); + +// preserveAspectRatio +storeSVGPropertyAsExpando("marker", "preserveAspectRatio"); + +// boolean +storeSVGPropertyAsExpando("feConvolveMatrix", "preserveAlpha"); + +// enum +storeSVGPropertyAsExpando("feConvolveMatrix", "edgeMode"); + +// special marker enum +storeSVGPropertyAsExpando("marker", "orientType"); + +// integer +storeSVGPropertyAsExpando("feConvolveMatrix", "orderX"); + +// length +storeSVGPropertyAsExpando("feConvolveMatrix", "x"); + +// number +storeSVGPropertyAsExpando("feConvolveMatrix", "divisor"); + +// string +storeSVGPropertyAsExpando("feConvolveMatrix", "in1"); + +var elem1 = document.createElementNS("http://www.w3.org/2000/svg", "switch"); +var elem2 = document.createElementNS("http://www.w3.org/2000/svg", "rect"); +elem1.appendChild(elem2); +document.getElementById("content").appendChild(elem1); + +elem2.addEventListener("click", function() {}); + +Object.prototype.valueOf.expando = elem1; + +ok(true, "SVG shouldn't leak."); + +]]> +</script> +</pre> +</body> +</html> |