layout/xul/crashtests/433429.xul

changeset 0
6474c204b198
     1.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     1.2 +++ b/layout/xul/crashtests/433429.xul	Wed Dec 31 06:09:35 2014 +0100
     1.3 @@ -0,0 +1,23 @@
     1.4 +<?xml version="1.0"?>
     1.5 +
     1.6 +<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
     1.7 +
     1.8 +<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">
     1.9 +
    1.10 +<script type="text/javascript">
    1.11 +
    1.12 +function boom()
    1.13 +{
    1.14 +  var listbox = document.getElementById("listbox");
    1.15 +
    1.16 +  listbox.removeChild(listbox.childNodes[1]);
    1.17 +  document.documentElement.style.MozBinding = "url('data:text/xml,%3Cbindings%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fxbl%22%3E%3Cbinding%20id%3D%22foo%22%3E%3Ccontent%3E%0A%3Chbox%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fkeymaster%2Fgatekeeper%2Fthere.is.only.xul%22%2F%3E%0A%3C%2Fcontent%3E%3C%2Fbinding%3E%3C%2Fbindings%3E%0A')";
    1.18 +  document.documentElement.boxObject.height;
    1.19 +  listbox.removeChild(listbox.childNodes[0]);
    1.20 +}
    1.21 +
    1.22 +</script>
    1.23 +
    1.24 +<listbox id="listbox" style="-moz-binding: url(data:text/xml,%3Cbindings%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fxbl%22%3E%3Cbinding%20id%3D%22foo%22%3E%3Ccontent%3E%0A%3Clistbox%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fkeymaster%2Fgatekeeper%2Fthere.is.only.xul%22%3E%3Cchildren%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fxbl%22%2F%3E%3C%2Flistbox%3E%0A%3C%2Fcontent%3E%3C%2Fbinding%3E%3C%2Fbindings%3E%0A);"><listitem/><listitem/></listbox>
    1.25 +
    1.26 +</window>

mercurial