| OLD | NEW |
| (Empty) |
| 1 <html> | |
| 2 <import src="../resources/dump-as-text.sky" /> | |
| 3 <import src="resources/document-register-fuzz.sky" as="fuzzer" /> | |
| 4 <body> | |
| 5 <div id="container"></div> | |
| 6 Fuzzing document.registerElement() through getters. PASS uless crash. | |
| 7 <script> | |
| 8 var badPrototype = Image.prototype; | |
| 9 var badConstructor = Image.prototype.constructor; | |
| 10 | |
| 11 fuzzer.setupObjectHooks({ | |
| 12 prototypeGet: function() { return badPrototype; }, | |
| 13 prototypeSet: function(value) { }, | |
| 14 constructorGet: function() { return badConstructor; }, | |
| 15 constructorSet: function(value) { } | |
| 16 }); | |
| 17 | |
| 18 fuzzer.exerciseDocumentRegister(); | |
| 19 </script> | |
| 20 </body> | |
| 21 </html> | |
| OLD | NEW |