| OLD | NEW |
| 1 <!DOCTYPE html> | 1 <!DOCTYPE html> |
| 2 <html> | 2 <html> |
| 3 <head> | 3 <head> |
| 4 <script src="../../../resources/js-test.js"></script> | 4 <script src="../../../resources/js-test.js"></script> |
| 5 <script src="./resources/document-register-fuzz.js"></script> | 5 <script src="./resources/document-register-fuzz.js"></script> |
| 6 </head> | 6 </head> |
| 7 <body> | 7 <body> |
| 8 <div id="container"></div> | 8 <div id="container"></div> |
| 9 <script> | 9 <script> |
| 10 description("Fuzzing document.register() through getters. PASS uless crash."); | 10 description("Fuzzing document.registerElement() through getters. PASS uless cras
h."); |
| 11 | 11 |
| 12 var badPrototype = Image.prototype; | 12 var badPrototype = Image.prototype; |
| 13 var badConstructor = Image.prototype.constructor; | 13 var badConstructor = Image.prototype.constructor; |
| 14 | 14 |
| 15 setupObjectHooks({ | 15 setupObjectHooks({ |
| 16 prototypeGet: function() { return badPrototype; }, | 16 prototypeGet: function() { return badPrototype; }, |
| 17 prototypeSet: function(value) { }, | 17 prototypeSet: function(value) { }, |
| 18 constructorGet: function() { return badConstructor; }, | 18 constructorGet: function() { return badConstructor; }, |
| 19 constructorSet: function(value) { } | 19 constructorSet: function(value) { } |
| 20 }); | 20 }); |
| 21 | 21 |
| 22 exerciseDocumentRegister(); | 22 exerciseDocumentRegister(); |
| 23 </script> | 23 </script> |
| 24 </body> | 24 </body> |
| 25 </html> | 25 </html> |
| OLD | NEW |