summaryrefslogtreecommitdiff
path: root/layout/xul/crashtests/377592-1.svg
diff options
context:
space:
mode:
Diffstat (limited to 'layout/xul/crashtests/377592-1.svg')
-rw-r--r--layout/xul/crashtests/377592-1.svg27
1 files changed, 27 insertions, 0 deletions
diff --git a/layout/xul/crashtests/377592-1.svg b/layout/xul/crashtests/377592-1.svg
new file mode 100644
index 0000000000..7371708f24
--- /dev/null
+++ b/layout/xul/crashtests/377592-1.svg
@@ -0,0 +1,27 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ onload="setTimeout(boom, 30);"
+ class="reftest-wait">
+
+
+<script>
+
+var emptyBinding = "url('data:text/xml,%3Cbindings%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fxbl%22%3E%3Cbinding%20id%3D%22foo%22%3E%3Ccontent%3E%0A%0A%20%20%20%20%0A%3C%2Fcontent%3E%3C%2Fbinding%3E%3C%2Fbindings%3E%0A')";
+
+function boom()
+{
+ var foreignObject = document.getElementById("foreignObject")
+ foreignObject.style.MozBinding = emptyBinding;
+
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+
+<foreignObject width="500" height="500" transform="scale(.7,.7)" id="foreignObject" y="300">
+ <xul:menuitem />
+</foreignObject>
+
+
+</svg>