summaryrefslogtreecommitdiffstats
path: root/dom/bindings/crashtests/stringbuffer-USVString.html
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--dom/bindings/crashtests/stringbuffer-USVString.html11
1 files changed, 11 insertions, 0 deletions
diff --git a/dom/bindings/crashtests/stringbuffer-USVString.html b/dom/bindings/crashtests/stringbuffer-USVString.html
new file mode 100644
index 0000000000..a193e732b9
--- /dev/null
+++ b/dom/bindings/crashtests/stringbuffer-USVString.html
@@ -0,0 +1,11 @@
+<!doctype html>
+<script>
+ var div = document.createElement("div");
+ // Need a long-enough string that when we get it from the DOM it will not get
+ // inlined and will be an external stringbuffer string.
+ var str = "http://" + (new Array(200).join("a"));
+ div.setAttribute("x", str);
+ str = div.getAttribute("x");
+ // Now pass it as a USVString
+ new URL(str);
+</script>