1.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000
1.2 +++ b/js/xpconnect/crashtests/509075-1.html Wed Dec 31 06:09:35 2014 +0100
1.3 @@ -0,0 +1,28 @@
1.4 +<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
1.5 +<html>
1.6 + <script>
1.7 +
1.8 + var txt = document.createTextNode("");
1.9 + var b = document.createElement("b");
1.10 + var w = b["watch"];
1.11 + var txtdg = txt["__lookupGetter__"];
1.12 + w["__defineGetter__"]("toString",txtdg);
1.13 + var obj = {
1.14 + variable: 910,
1.15 + fun: function() {
1.16 + w["toString"]();
1.17 + }
1.18 + };
1.19 +
1.20 + function vuln()
1.21 + {
1.22 + window.status = "" + obj.variable;
1.23 + try{
1.24 + obj.fun();
1.25 + }catch(er){}
1.26 + return obj;
1.27 + }
1.28 +
1.29 + var ret = vuln();
1.30 + </script>
1.31 +</html>
