gecko-dev/dom/base/crashtests/898906.html

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<script>

var plug = navigator.plugins[0];
var mime = plug[0];
// This shouldn't leak.
mime.expando = true;

</script>
</head>
</html>
Bug 898906. Fix this bug by making nsMimeType objects hold their active plugin alive, and rely on the cycle collector to break the explicit reference cycle. r=mccr8 --- dom/base/crashtests/898906.html \| 14 ++++++++++++++ dom/base/crashtests/crashtests.list \| 3 ++- dom/base/nsMimeTypeArray.cpp \| 2 +- dom/base/nsMimeTypeArray.h \| 14 ++++++-------- dom/base/nsPluginArray.cpp \| 24 +----------------------- dom/base/nsPluginArray.h \| 2 -- 6 files changed, 24 insertions(+), 35 deletions(-) create mode 100644 dom/base/crashtests/898906.html 2013-07-31 04:46:46 +04:00			`<!DOCTYPE html>`
			`<html>`
			`<head>`
			`<meta charset="UTF-8">`
			`<script>`

			`var plug = navigator.plugins[0];`
			`var mime = plug[0];`
			`// This shouldn't leak.`
			`mime.expando = true;`

			`</script>`
			`</head>`
			`</html>`