1 files changed, 84 insertions, 0 deletions
diff --git a/dom/svg/test/test_valueLeaks.xhtml b/dom/svg/test/test_valueLeaks.xhtml
new file mode 100644
index 0000000000..ce816efc1c
--- /dev/null
+++ b/dom/svg/test/test_valueLeaks.xhtml
@@ -0,0 +1,84 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=467671
+-->
+<head>
+  <title>Test for Bug 467671</title>
+  <script src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=467671">Mozilla Bug 467671</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+  
+</div>
+<pre id="test">
+<script type="application/javascript">
+<![CDATA[
+
+/** Test for Bug 467671 **/
+
+function storeSVGPropertyAsExpando(localName, prop) {
+    var elem = document.createElementNS("http://www.w3.org/2000/svg", localName);
+
+    elem.addEventListener("click", function() {});
+
+    var propVal = elem[prop];
+    Object.prototype.valueOf[prop + "_expando"] = propVal;
+    if (propVal instanceof SVGAnimatedAngle || propVal instanceof SVGAnimatedLength ||
+        propVal instanceof SVGAnimatedRect || propVal instanceof SVGAnimatedPreserveAspectRatio) {
+        Object.prototype.valueOf[prop + "_baseVal_expando"] = propVal.baseVal;
+        Object.prototype.valueOf[prop + "_animVal_expando"] = propVal.animVal;
+    }
+}
+
+// class
+storeSVGPropertyAsExpando("marker", "class");
+
+// angle
+storeSVGPropertyAsExpando("marker", "orientAngle");
+
+// viewBox
+storeSVGPropertyAsExpando("marker", "viewBox");
+
+// preserveAspectRatio
+storeSVGPropertyAsExpando("marker", "preserveAspectRatio");
+
+// boolean
+storeSVGPropertyAsExpando("feConvolveMatrix", "preserveAlpha");
+
+// enum
+storeSVGPropertyAsExpando("feConvolveMatrix", "edgeMode");
+
+// special marker enum
+storeSVGPropertyAsExpando("marker", "orientType");
+
+// integer
+storeSVGPropertyAsExpando("feConvolveMatrix", "orderX");
+
+// length
+storeSVGPropertyAsExpando("feConvolveMatrix", "x");
+
+// number
+storeSVGPropertyAsExpando("feConvolveMatrix", "divisor");
+
+// string
+storeSVGPropertyAsExpando("feConvolveMatrix", "in1");
+
+var elem1 = document.createElementNS("http://www.w3.org/2000/svg", "switch");
+var elem2 = document.createElementNS("http://www.w3.org/2000/svg", "rect");
+elem1.appendChild(elem2);
+document.getElementById("content").appendChild(elem1);
+
+elem2.addEventListener("click", function() {});
+
+Object.prototype.valueOf.expando = elem1;
+
+ok(true, "SVG shouldn't leak.");
+
+]]>
+</script>
+</pre>
+</body>
+</html>