| OLD | NEW |
| 1 <!DOCTYPE html> | 1 <!DOCTYPE html> |
| 2 <html> | 2 <html> |
| 3 <script> | 3 <script> |
| 4 if (window.testRunner) | 4 if (window.testRunner) |
| 5 testRunner.dumpAsText(); | 5 testRunner.dumpAsText(); |
| 6 | 6 |
| 7 var docElement = document.documentElement; | 7 var docElement = document.documentElement; |
| 8 function crash() { | 8 function crash() { |
| 9 svgAnimAttributeElement1 = document.createElementNS("http://www.w3.org/2000/
svg", "animattributeattrs"); | 9 svgAnimAttributeElement1 = document.createElementNS("http://www.w3.org/2000/
svg", "animattributeattrs"); |
| 10 mathElement1 = document.createElementNS("http://www.w3.org/1998/Math/MathML"
, "math"); | |
| 11 mathElement1.setAttribute("class", "c0"); | |
| 12 svgAnimateElement1 = document.createElementNS("http://www.w3.org/2000/svg",
"animate"); | 10 svgAnimateElement1 = document.createElementNS("http://www.w3.org/2000/svg",
"animate"); |
| 13 svgTestcaseElement1 = document.createElementNS("http://www.w3.org/2000/svg",
"svgtestcase"); | 11 svgTestcaseElement1 = document.createElementNS("http://www.w3.org/2000/svg",
"svgtestcase"); |
| 14 svgEllipseElement1 = document.createElementNS("http://www.w3.org/2000/svg",
"ellipse"); | 12 svgEllipseElement1 = document.createElementNS("http://www.w3.org/2000/svg",
"ellipse"); |
| 15 mathElement2 = document.createElementNS("http://www.w3.org/1998/Math/MathML"
, "math"); | 13 mathElement1 = document.createElementNS("http://www.w3.org/1998/Math/MathML"
, "math"); |
| 16 docElement.appendChild(mathElement2); | 14 docElement.appendChild(mathElement1); |
| 17 svgLineElement1 = document.createElementNS("http://www.w3.org/2000/svg", "li
ne"); | 15 svgLineElement1 = document.createElementNS("http://www.w3.org/2000/svg", "li
ne"); |
| 18 textNode1 = document.createTextNode("mNfma;B N`p0ag "); | 16 textNode1 = document.createTextNode("mNfma;B N`p0ag "); |
| 19 svgEllipseElement1.addEventListener("touchcancel", function () {}, false); | 17 svgEllipseElement1.addEventListener("touchcancel", function () {}, false); |
| 20 document1 = document.implementation.createDocument("", null); | 18 document1 = document.implementation.createDocument("", null); |
| 21 svgAnimateElement1.appendChild(svgEllipseElement1); | 19 svgAnimateElement1.appendChild(svgEllipseElement1); |
| 22 mathElement1.attributes[0].appendChild(textNode1); | 20 mathElement1.appendChild(svgAnimateElement1); |
| 23 mathElement2.appendChild(svgAnimateElement1); | |
| 24 document1.appendChild(svgLineElement1); | 21 document1.appendChild(svgLineElement1); |
| 25 svgLineElement1.appendChild(svgTestcaseElement1); | 22 svgLineElement1.appendChild(svgTestcaseElement1); |
| 26 mathElement1.attributes[0].addEventListener("DOMSubtreeModified", function (
) { document.open(); }, false); | |
| 27 svgTestcaseElement1.appendChild(svgAnimAttributeElement1); | 23 svgTestcaseElement1.appendChild(svgAnimAttributeElement1); |
| 28 document2 = document.implementation.createDocument("http://www.w3.org/1999/x
html", "html"); document2.adoptNode(textNode1); | 24 document2 = document.implementation.createDocument("http://www.w3.org/1999/x
html", "html"); document2.adoptNode(textNode1); |
| 29 svgAnimAttributeElement1.appendChild(mathElement2); | 25 svgAnimAttributeElement1.appendChild(mathElement1); |
| 30 svgEllipseElement1.parentNode.removeChild(svgEllipseElement1); | 26 svgEllipseElement1.parentNode.removeChild(svgEllipseElement1); |
| 31 delete svgEllipseElement1; | 27 delete svgEllipseElement1; |
| 32 gc(); | 28 gc(); |
| 33 document.open(); | 29 document.open(); |
| 34 document.write("Passed. Test didn't crash."); | 30 document.write("Passed. Test didn't crash."); |
| 35 document.close(); | 31 document.close(); |
| 36 } | 32 } |
| 37 document.addEventListener("DOMContentLoaded", crash, false); | 33 document.addEventListener("DOMContentLoaded", crash, false); |
| 38 </script> | 34 </script> |
| 39 </html> | 35 </html> |
| OLD | NEW |