gecko-dev/dom/base/crashtests/1411473.html

<html>
  <head class="reftest-wait">
    <script>
      var img = new Image(-256, 1024);
      img.src = 'data:;base64,R0lGODlhAQABAAAAACwAAAAAAQABAAA';
      img.onload = function () {
        img.crossOrigin ="Anonymous";
        document.implementation.createDocument('', '', null).adoptNode(img);
      };
    </script>
  </head>
</html>
Bug 1411473 - Skip image loading from adoption if OwnerDoc is not allowed to. r=bz In the test file 1411473.html, there are 3 calls to nsImageLoadingContent::LoadImage 1. Triggered by setting src attribute, and this sets the mCurrentRequest. 2. Triggered by setting crossOrigin attribute, this forcibly reloads the image, and this sets the mPendingRequest. 3. Triggered by loading the image which is adopted into a new created data document by 'document.implementation.createDocument('', '', null).adoptNode(img)' However in the 3rd call, when it calls nsImageLoadingContent::LoadImage, It will bail out in the aDocument->IsLoadedAsData() part http://searchfox.org/mozilla-central/rev/5a60492a53667fc61a62af1847d005a210b7a4f6/dom/base/nsImageLoadingContent.cpp#942 And when it calls SetBlockedRequest, at this time we have a non-null mCurrentRequest and a non-null mPendingRequest, so this triggers the assertion of mPendingRequest should be null when we got blocked, which is added in bug 1267075. Since data document is not the active document, per https://html.spec.whatwg.org/multipage/images.html#updating-the-image-data, Step 1, we should skip the image loading in HTMLImageElement. 2017-11-07 11:06:26 +03:00			`<html>`
			`<head class="reftest-wait">`
			`<script>`
			`var img = new Image(-256, 1024);`
			`img.src = 'data:;base64,R0lGODlhAQABAAAAACwAAAAAAQABAAA';`
			`img.onload = function () {`
			`img.crossOrigin ="Anonymous";`
			`document.implementation.createDocument('', '', null).adoptNode(img);`
			`};`
			`</script>`
			`</head>`
			`</html>`