js/src/jit-test/tests/auto-regress/bug488015.js

Wed, 31 Dec 2014 06:09:35 +0100

author
Michael Schloh von Bennewitz <michael@schloh.com>
date
Wed, 31 Dec 2014 06:09:35 +0100
changeset 0
6474c204b198
permissions
-rw-r--r--

Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.

michael@0 1 // Binary: cache/js-dbg-64-e1257570fef8-linux
michael@0 2 // Flags:
michael@0 3 //
michael@0 4 var a = [];
michael@0 5 function addEventListener(e, f, g)
michael@0 6 {
michael@0 7 a.push(f);
michael@0 8 }
michael@0 9 function setTimeout(f, t)
michael@0 10 {
michael@0 11 a.push(f);
michael@0 12 }
michael@0 13 var b;
michael@0 14 this.document = {};
michael@0 15 function e(w) {
michael@0 16 addEventListener("mousedown", d, true);
michael@0 17 function d() {
michael@0 18 var d;
michael@0 19 w.setTimeout(function() {
michael@0 20 b(d);
michael@0 21 }, 0);
michael@0 22 }
michael@0 23 function b(d){
michael@0 24 w.document; /* Crash Here!! */
michael@0 25 }
michael@0 26 }
michael@0 27 e(this);
michael@0 28 a[0]();
michael@0 29 a[1]();

mercurial