1.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000
1.2 +++ b/js/xpconnect/crashtests/453935-1.html Wed Dec 31 06:09:35 2014 +0100
1.3 @@ -0,0 +1,37 @@
1.4 +<!DOCTYPE html>
1.5 +<html>
1.6 +<head>
1.7 +<script type="text/javascript">
1.8 +
1.9 +function boom()
1.10 +{
1.11 + var a = [];
1.12 + a[31] = undefined;
1.13 + a[40] = undefined;
1.14 + a[44] = {};
1.15 + a[45] = new XMLHttpRequest();
1.16 + a[48] = new XMLHttpRequest();
1.17 + a[53] = XMLHttpRequest.prototype;
1.18 + a[53].__proto__ = {};
1.19 + a[53].nodeType = 100;
1.20 + search(a, 41);
1.21 +}
1.22 +
1.23 +
1.24 +function search(a, start)
1.25 +{
1.26 + var N = a.length;
1.27 +
1.28 + for (var j = start; j < N; ++j) {
1.29 + var e = a[j];
1.30 + if (typeof e == "object" && "nodeType" in e && e.nodeType == 99)
1.31 + return j;
1.32 + }
1.33 +
1.34 + return null;
1.35 +}
1.36 +
1.37 +</script>
1.38 +</head>
1.39 +<body onload="boom();"></body>
1.40 +</html>
