OLD | NEW |
| (Empty) |
1 <html> | |
2 <link rel="import" href="../resources/dump-as-text.html" /> | |
3 <link rel="import" href="resources/document-register-fuzz.html" as="fuzzer" /> | |
4 <body> | |
5 <div id="container"></div> | |
6 Fuzzing document.registerElement() through getters. PASS uless crash. | |
7 <script> | |
8 var badPrototype = Image.prototype; | |
9 var badConstructor = Image.prototype.constructor; | |
10 | |
11 fuzzer.setupObjectHooks({ | |
12 prototypeGet: function() { return badPrototype; }, | |
13 prototypeSet: function(value) { }, | |
14 constructorGet: function() { return badConstructor; }, | |
15 constructorSet: function(value) { } | |
16 }); | |
17 | |
18 fuzzer.exerciseDocumentRegister(); | |
19 </script> | |
20 </body> | |
21 </html> | |
OLD | NEW |