OLD | NEW |
1 <!DOCTYPE html> | 1 <!DOCTYPE html> |
2 <html> | 2 <html> |
3 <script> | 3 <script> |
4 if (window.testRunner) | 4 if (window.testRunner) |
5 testRunner.dumpAsText(); | 5 testRunner.dumpAsText(); |
6 | 6 |
7 var docElement = document.documentElement; | 7 var docElement = document.documentElement; |
8 function crash() { | 8 function crash() { |
9 svgAnimAttributeElement1 = document.createElementNS("http://www.w3.org/2000/
svg", "animattributeattrs"); | 9 svgAnimAttributeElement1 = document.createElementNS("http://www.w3.org/2000/
svg", "animattributeattrs"); |
10 mathElement1 = document.createElementNS("http://www.w3.org/1998/Math/MathML"
, "math"); | |
11 mathElement1.setAttribute("class", "c0"); | |
12 svgAnimateElement1 = document.createElementNS("http://www.w3.org/2000/svg",
"animate"); | 10 svgAnimateElement1 = document.createElementNS("http://www.w3.org/2000/svg",
"animate"); |
13 svgTestcaseElement1 = document.createElementNS("http://www.w3.org/2000/svg",
"svgtestcase"); | 11 svgTestcaseElement1 = document.createElementNS("http://www.w3.org/2000/svg",
"svgtestcase"); |
14 svgEllipseElement1 = document.createElementNS("http://www.w3.org/2000/svg",
"ellipse"); | 12 svgEllipseElement1 = document.createElementNS("http://www.w3.org/2000/svg",
"ellipse"); |
15 mathElement2 = document.createElementNS("http://www.w3.org/1998/Math/MathML"
, "math"); | 13 mathElement1 = document.createElementNS("http://www.w3.org/1998/Math/MathML"
, "math"); |
16 docElement.appendChild(mathElement2); | 14 docElement.appendChild(mathElement1); |
17 svgLineElement1 = document.createElementNS("http://www.w3.org/2000/svg", "li
ne"); | 15 svgLineElement1 = document.createElementNS("http://www.w3.org/2000/svg", "li
ne"); |
18 textNode1 = document.createTextNode("mNfma;B N`p0ag "); | 16 textNode1 = document.createTextNode("mNfma;B N`p0ag "); |
19 svgEllipseElement1.addEventListener("touchcancel", function () {}, false); | 17 svgEllipseElement1.addEventListener("touchcancel", function () {}, false); |
20 document1 = document.implementation.createDocument("", null); | 18 document1 = document.implementation.createDocument("", null); |
21 svgAnimateElement1.appendChild(svgEllipseElement1); | 19 svgAnimateElement1.appendChild(svgEllipseElement1); |
22 mathElement1.attributes[0].appendChild(textNode1); | 20 mathElement1.appendChild(svgAnimateElement1); |
23 mathElement2.appendChild(svgAnimateElement1); | |
24 document1.appendChild(svgLineElement1); | 21 document1.appendChild(svgLineElement1); |
25 svgLineElement1.appendChild(svgTestcaseElement1); | 22 svgLineElement1.appendChild(svgTestcaseElement1); |
26 mathElement1.attributes[0].addEventListener("DOMSubtreeModified", function (
) { document.open(); }, false); | |
27 svgTestcaseElement1.appendChild(svgAnimAttributeElement1); | 23 svgTestcaseElement1.appendChild(svgAnimAttributeElement1); |
28 document2 = document.implementation.createDocument("http://www.w3.org/1999/x
html", "html"); document2.adoptNode(textNode1); | 24 document2 = document.implementation.createDocument("http://www.w3.org/1999/x
html", "html"); document2.adoptNode(textNode1); |
29 svgAnimAttributeElement1.appendChild(mathElement2); | 25 svgAnimAttributeElement1.appendChild(mathElement1); |
30 svgEllipseElement1.parentNode.removeChild(svgEllipseElement1); | 26 svgEllipseElement1.parentNode.removeChild(svgEllipseElement1); |
31 delete svgEllipseElement1; | 27 delete svgEllipseElement1; |
32 gc(); | 28 gc(); |
33 document.open(); | 29 document.open(); |
34 document.write("Passed. Test didn't crash."); | 30 document.write("Passed. Test didn't crash."); |
35 document.close(); | 31 document.close(); |
36 } | 32 } |
37 document.addEventListener("DOMContentLoaded", crash, false); | 33 document.addEventListener("DOMContentLoaded", crash, false); |
38 </script> | 34 </script> |
39 </html> | 35 </html> |
OLD | NEW |