gecko-dev/dom/svg/crashtests/1513603.html

<script>
function go() {
  b.addEventListener("DOMSubtreeModified", eh)
  b.max = 0.44
  b.value = 0.94
}
function eh() {
  SpecialPowers.gc()
  SpecialPowers.forceCC()
  polygon.animatedPoints.z = 1;
  path.animatedPathSegList.z = 1;
  svg.requiredExtensions.z = 1;
}
</script>
<body onload=go()>
<svg id="svg">
<polygon id="polygon"/>
<path id="path"/>
<dl>
<meter id="b">
Bug 1513603 - Remove SVG tearoff objects from the table when they are unlinked. r=longsonr The only three types that can hit the PreservedWrapper() assertion currently, and which this patch avoids, are DOMSVGPathSegList, DOMSVGPointList, and DOMSVGStringList. This is because these are the only types that are implemented as proxies (due to having e.g. indexed getters on them, and thus have the offending DOMProxyHandler::GetExpandoObject() call in their bindings) and which we store in tearoff tables. Differential Revision: https://phabricator.services.mozilla.com/D70314 --HG-- extra : moz-landing-system : lando 2020-04-09 15:50:28 +03:00			`<script>`
			`function go() {`
			`b.addEventListener("DOMSubtreeModified", eh)`
			`b.max = 0.44`
			`b.value = 0.94`
			`}`
			`function eh() {`
			`SpecialPowers.gc()`
			`SpecialPowers.forceCC()`
			`polygon.animatedPoints.z = 1;`
			`path.animatedPathSegList.z = 1;`
			`svg.requiredExtensions.z = 1;`
			`}`
			`</script>`
			`<body onload=go()>`
			`<svg id="svg">`
			`<polygon id="polygon"/>`
			`<path id="path"/>`
			`<dl>`
			`<meter id="b">`