OLD | NEW |
1 <!DOCTYPE html> | 1 <!DOCTYPE html> |
2 <html> | 2 <html> |
3 <head> | 3 <head> |
4 <script src="../../../resources/js-test.js"></script> | 4 <script src="../../../resources/js-test.js"></script> |
5 <script src="./resources/document-register-fuzz.js"></script> | 5 <script src="./resources/document-register-fuzz.js"></script> |
6 </head> | 6 </head> |
7 <body> | 7 <body> |
8 <div id="container"></div> | 8 <div id="container"></div> |
9 <script> | 9 <script> |
10 description("Fuzzing document.register() through getters. PASS uless crash."); | 10 description("Fuzzing document.registerElement() through getters. PASS uless cras
h."); |
11 | 11 |
12 var badPrototype = Image.prototype; | 12 var badPrototype = Image.prototype; |
13 var badConstructor = Image.prototype.constructor; | 13 var badConstructor = Image.prototype.constructor; |
14 | 14 |
15 setupObjectHooks({ | 15 setupObjectHooks({ |
16 prototypeGet: function() { return badPrototype; }, | 16 prototypeGet: function() { return badPrototype; }, |
17 prototypeSet: function(value) { }, | 17 prototypeSet: function(value) { }, |
18 constructorGet: function() { return badConstructor; }, | 18 constructorGet: function() { return badConstructor; }, |
19 constructorSet: function(value) { } | 19 constructorSet: function(value) { } |
20 }); | 20 }); |
21 | 21 |
22 exerciseDocumentRegister(); | 22 exerciseDocumentRegister(); |
23 </script> | 23 </script> |
24 </body> | 24 </body> |
25 </html> | 25 </html> |
OLD | NEW |