js/src/jit-test/tests/auto-regress/bug488015.js@b8a032363ba2
js/src/jit-test/tests/auto-regress/bug488015.js
Thu, 22 Jan 2015 13:21:57 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Thu, 22 Jan 2015 13:21:57 +0100
- branch
- TOR_BUG_9701
- changeset 15
- b8a032363ba2
- permissions
- -rw-r--r--
Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6
1 // Binary: cache/js-dbg-64-e1257570fef8-linux
2 // Flags:
3 //
4 var a = [];
5 function addEventListener(e, f, g)
6 {
7 a.push(f);
8 }
9 function setTimeout(f, t)
10 {
11 a.push(f);
12 }
13 var b;
14 this.document = {};
15 function e(w) {
16 addEventListener("mousedown", d, true);
17 function d() {
18 var d;
19 w.setTimeout(function() {
20 b(d);
21 }, 0);
22 }
23 function b(d){
24 w.document; /* Crash Here!! */
25 }
26 }
27 e(this);
28 a[0]();
29 a[1]();
