wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-19 23:07:33 +09:00
Code Issues Projects Releases Packages Wiki Activity

moebius#76: JS - DOM - Selection API - crashes

Browse source 
https://github.com/MoonchildProductions/moebius/pull/76
This commit is contained in:
janekptacijarabaci 2018-04-13 20:57:00 +02:00 • committed by Roy Tam
commit 81228c3a44
3 changed files with 24 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

22
dom/html/crashtests/1350972.html Normal file
View file

@ -0,0 +1,22 @@
<!DOCTYPE html>
<html>
<head>
<script>
try { o1 = document.createElement('tr'); } catch(e) {};
try { o2 = document.createElement('div'); } catch(e) {};
try { o3 = document.createElement('hr'); } catch(e) {};
try { o4 = document.createElement('textarea'); } catch(e) {};
try { o5 = document.getSelection(); } catch(e) {};
try { o6 = document.createRange(); } catch(e) {};
try { document.documentElement.appendChild(o2); } catch(e) {};
try { document.documentElement.appendChild(o3); } catch(e) {};
try { o2.appendChild(o4); } catch(e) {};
try { o3.outerHTML = "<noscript contenteditable='true'>"; } catch(e) {};
try { o4.select(); } catch(e) {};
try { o5.addRange(o6); } catch(e) {};
try { document.documentElement.appendChild(o1); } catch(e) {};
try { o5.selectAllChildren(o1); } catch(e) {};
try { o6.selectNode(o1); } catch(e) {};
</script>
</head>
</html>