The Tor Browser / file comparison
comparison: xpcom/string/crashtests/395651-1.html
xpcom/string/crashtests/395651-1.html
- branch
- TOR_BUG_3246
- changeset 7
- 129ffea94266
equal
deleted
inserted
replaced
| -1:000000000000 | 0:768c8ad51645 |
|---|---|
| 1 <html> | |
| 2 <head> | |
| 3 <script> | |
| 4 | |
| 5 function X() { dump("X\n"); } | |
| 6 function Y() { dump("Y\n"); } | |
| 7 | |
| 8 function boom() | |
| 9 { | |
| 10 dump("Start9\n"); | |
| 11 | |
| 12 var div = document.getElementById("v"); | |
| 13 | |
| 14 var textNode = document.createTextNode(String.fromCharCode(0xDAAF)); // high surrogate | |
| 15 div.appendChild(textNode); | |
| 16 | |
| 17 document.addEventListener("DOMCharacterDataModified", X, true); | |
| 18 textNode.data += 'B'; | |
| 19 document.removeEventListener("DOMCharacterDataModified", X, true); | |
| 20 | |
| 21 document.addEventListener("DOMAttrModified", Y, true); | |
| 22 textNode.data += String.fromCharCode(0xDF53); // low surrogate | |
| 23 document.removeEventListener("DOMAttrModified", Y, true); | |
| 24 } | |
| 25 | |
| 26 </script> | |
| 27 </head> | |
| 28 | |
| 29 <body onload="boom();"><div id="v"></div></body> | |
| 30 | |
| 31 </html> |
