Bug 1402157 - Test draft
authorcku <cku@mozilla.com>
Thu, 19 Oct 2017 00:29:44 +0800
changeset 682753 b81bcc9c902132a4d472f36fd167c932651f0f7d
parent 682335 75545316c72d9fe2081b7244c1e5c63222f40465
child 736415 2465da16abf41c6090829a492f16054f947579e6
push id85128
push usercku@mozilla.com
push dateWed, 18 Oct 2017 17:40:00 +0000
bugs1402157
milestone58.0a1
Bug 1402157 - Test MozReview-Commit-ID: Bowesp5YOTf
layout/style/crashtests/1402157.html
--- a/layout/style/crashtests/1402157.html
+++ b/layout/style/crashtests/1402157.html
@@ -1,20 +1,24 @@
 <style>
 #b { mask-image: url(#b); }
 </style>
 <script>
-let triggered = false;
-function boom() {
-  document.body.appendChild(document.body.firstChild);
-  if (!triggered) {
-    triggered = true;
-    a.load();
-    history.replaceState('', '', '?foo');
-  }
+function GetVariable(fuzzervars, var_type) { return fuzzervars[var_type]; }
+function SetVariable(fuzzervars, var_name, var_type) { fuzzervars[var_type] = var_name; }
+function eh1() {
+  var fuzzervars = {};
+  SetVariable(fuzzervars, document.body.firstChild, 'Element');
+  try { document.body.appendChild(GetVariable(fuzzervars, 'Element')); } catch(e) { }
+  try { a.load(); } catch(e) { }
+  try { window.self.history.replaceState( window.self.history.state, '', "foo"); } catch(e) { }
+}
+function eh2() {
+  try { a.src = "x"; } catch(e) { }
 }
 </script>
-<body><sub id="b">
-  <audio id="a" src="foo" onerror="boom()"></audio>
+<sub id="b">
+<audio id="a" onerror="eh1()">
+</audio>
 <option>
 </sub>
-<ul></ul>
-</body>
+<ol>
+<img src="x" onerror="eh2()"></img>
\ No newline at end of file