1.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000 1.2 +++ b/layout/xul/crashtests/433429.xul Wed Dec 31 06:09:35 2014 +0100 1.3 @@ -0,0 +1,23 @@ 1.4 +<?xml version="1.0"?> 1.5 + 1.6 +<?xml-stylesheet href="chrome://global/skin/" type="text/css"?> 1.7 + 1.8 +<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();"> 1.9 + 1.10 +<script type="text/javascript"> 1.11 + 1.12 +function boom() 1.13 +{ 1.14 + var listbox = document.getElementById("listbox"); 1.15 + 1.16 + listbox.removeChild(listbox.childNodes[1]); 1.17 + document.documentElement.style.MozBinding = "url('data:text/xml,%3Cbindings%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fxbl%22%3E%3Cbinding%20id%3D%22foo%22%3E%3Ccontent%3E%0A%3Chbox%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fkeymaster%2Fgatekeeper%2Fthere.is.only.xul%22%2F%3E%0A%3C%2Fcontent%3E%3C%2Fbinding%3E%3C%2Fbindings%3E%0A')"; 1.18 + document.documentElement.boxObject.height; 1.19 + listbox.removeChild(listbox.childNodes[0]); 1.20 +} 1.21 + 1.22 +</script> 1.23 + 1.24 +<listbox id="listbox" style="-moz-binding: url(data:text/xml,%3Cbindings%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fxbl%22%3E%3Cbinding%20id%3D%22foo%22%3E%3Ccontent%3E%0A%3Clistbox%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fkeymaster%2Fgatekeeper%2Fthere.is.only.xul%22%3E%3Cchildren%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fxbl%22%2F%3E%3C%2Flistbox%3E%0A%3C%2Fcontent%3E%3C%2Fbinding%3E%3C%2Fbindings%3E%0A);"><listitem/><listitem/></listbox> 1.25 + 1.26 +</window>