summaryrefslogtreecommitdiffstats
path: root/dom/svg/crashtests/1715387.html
blob: 7de6499f8211c532c80cef718bd64465f0475898 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
<!DOCTYPE html>
<html class="reftest-wait">
<style>
svg {
  width: 10%;
  height: 10%;
  background: #eee;
}
svg path {
  fill: none;
  stroke: #000;
}

</style>
<script>
  function run() {
    const target = document.createElementNS("http://www.w3.org/2000/svg", "path");
    const root = document.getElementById('svgroot');
    root.appendChild(target);
    target.style.d = 'path("M0,0 L2,2")';

    var m = new MutationObserver(function () {
      // This will destroy the oringal document.
      document.write("<html><body></body></html>");
      SpecialPowers.forceGC();
      SpecialPowers.forceCC();

      document.documentElement.classList.remove("reftest-wait");
    });

    m.observe(target, { attributes: true });
    target.setAttribute("d", "none");

    // Calling these APIs flushes the style, which may run the script in the
    // callback function above that destroys the composed document.
    target.getTotalLength();
    target.getPointAtLength(1);
    target.isPointInFill({x: 1, y: 1});
    target.isPointInStroke({x: 1, y: 1});
    target.getPathSegAtLength(0);
  }
</script>
<body onload="run()">
<svg viewBox="0 0 20 20" id="svgroot">
</svg>