bug 382568 - crash test by Vlad Sukhoy.
authorBob Clary <bclary@bclary.com>
Fri, 24 Apr 2009 10:08:19 -0700
changeset 27775 ae37a2531c4ba86dbacf7619930eba38e031d60a
parent 27774 a53ccd54282ed64a8cd093e9389ef4102bef0547
child 27776 e37c7a3a82dfcd34a25e4f0f78de599e763c0c2c
push id6720
push userbclary@mozilla.com
push dateFri, 24 Apr 2009 17:10:36 +0000
treeherderautoland@a1e84240b5c9 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs382568
milestone1.9.2a1pre
bug 382568 - crash test by Vlad Sukhoy.
content/html/content/crashtests/382568-1-inner.xhtml
content/html/content/crashtests/382568-1.html
content/html/content/crashtests/crashtests.list
new file mode 100644
--- /dev/null
+++ b/content/html/content/crashtests/382568-1-inner.xhtml
@@ -0,0 +1,52 @@
+<?xml version="1.0"?>
+<!DOCTYPE html
+PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html  xmlns="http://www.w3.org/1999/xhtml"> <head>
+<title>Test</title>
+<script type="text/javascript"><![CDATA[
+
+function onAttrModified(evt) {
+//  window.alert("Mutation event fired within the frame code.");
+//  evt.target.focus();
+//  evt.target.blur();
+  evt.target.style.background = 'green';
+  bounce(evt.target);
+//  evt.target.normalize();
+//  bounce(evt.target.parentNode);
+}
+function die(n) {
+  p = n.parentNode;
+  p.removeChild(n);
+}
+
+function bounce(n) {
+  p = n.parentNode;
+  p.removeChild(n);
+  p.appendChild(n);
+}
+
+
+function test_AttrModified() {
+  var x = document.getElementById("x");
+  x.addEventListener("DOMAttrModified", onAttrModified, false);
+  bounce(x);
+}
+
+function test() {
+  setTimeout(test_AttrModified, 3000);
+}
+]]></script>
+</head>
+
+<body onload="test()">
+<h1>TestCase for unsafe mutable events from textarea</h1>
+<p>Please wait for 3 seconds after document was loaded,
+if your browser is vulnerable, it may stop responding
+to keyboard and mouse event
+and most likely it will eventually crash (may take a
+while for debug builds).</p>
+<p>
+<textarea id="x"></textarea>
+</p>
+</body> </html>
new file mode 100644
--- /dev/null
+++ b/content/html/content/crashtests/382568-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 3500);
+</script>
+<body>
+<iframe src="382568-1-inner.xhtml"></iframe>
+</body>
+</html>
--- a/content/html/content/crashtests/crashtests.list
+++ b/content/html/content/crashtests/crashtests.list
@@ -1,10 +1,11 @@
 load 68912-1.html
 load 257818-1.html
 load 307616-1.html
 load 324918-1.xhtml
 load 338649-1.xhtml
 load 339501-1.xhtml
 load 339501-2.xhtml
+load 382568-1.html
 load 423371-1.html
 load 451123-1.html
 load 453406-1.html