The Tor Browser: image/test/crashtests/ownerdiscard.html@ca08bd8f51b2

     1 <!DOCTYPE html>

     2 <html class="reftest-wait">

     3 <body>

     4   <div id=tCF0>

     5     <img id=victim src=ie.png>

     6     <iframe src=discardframe.htm></iframe>

     7   </div>

     8   <script>

     9     const Ci = SpecialPowers.Ci;

    10     const Cc = SpecialPowers.Cc;

    12     function ImageDecoderObserverStub()

    13     {

    14       this.sizeAvailable = function sizeAvailable(aRequest)   {}

    15       this.frameComplete = function frameComplete(aRequest)   {}

    16       this.decodeComplete = function decodeComplete(aRequest) {}

    17       this.loadComplete = function loadComplete(aRequest)     {}

    18       this.frameUpdate = function frameUpdate(aRequest)       {}

    19       this.discard = function discard(aRequest)               {}

    20       this.isAnimated = function isAnimated(aRequest)         {}

    21     }

    22     var img = document.getElementById('victim');

    23     var observer = new ImageDecoderObserverStub();

    24     observer.discard = function() {

    25       SpecialPowers.clearUserPref('min_discard_timeout_ms');

    26       imgLoadingContent.removeObserver(gObserver);

    27       setTimeout("document.documentElement.className = '';", 0);

    28     }

    29     observer = SpecialPowers.wrapCallbackObject(observer);

    30     var gObserver = Cc["@mozilla.org/image/tools;1"].getService(Ci.imgITools)

    31                                                     .createScriptedObserver(observer);

    32     var imgLoadingContent =

    33       SpecialPowers.wrap(img).QueryInterface(Ci.nsIImageLoadingContent);

    34     imgLoadingContent.addObserver(gObserver);

    36     SpecialPowers.setBoolPref('min_discard_timeout_ms', 1);

    38     function initCF() {

    39       setTimeout(function() { document.adoptNode(tCF0); }, 0);

    40     }

    41     document.addEventListener("DOMContentLoaded", initCF, false);

    42     function finish() {

    43       setTimeout("document.documentElement.className = '';", 30000);

    44     }

    45     window.addEventListener("load", finish, false);

    46   </script>

    47 </body>

    48 </html>

The Tor Browser / file revision