Bug 1370793 - Part 2: Crashtest. r=bholley

MozReview-Commit-ID: 1vepQTv40DQ --HG-- extra : rebase_source : 9b8341ec338a4f4f2b031372dcad00edc168035e
2017-06-11 19:12:16 +08:00 · 2017-06-11 19:12:16 +08:00 · 1abc353e33
--- a/layout/style/crashtests/1370793-1.xhtml
+++ b/layout/style/crashtests/1370793-1.xhtml
@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <bindings xmlns="http://www.mozilla.org/xbl">
+      <binding id="a">
+        <content>
+          <children/>
+        </content>
+      </binding>
+    </bindings>
+    <script>
+      function doTest() {
+        // Cause XBL bindings to be attached to the object element by
+        // wrapping it for JS.
+        document.querySelector("object");
+      }
+    </script>
+  </head>
+  <body onload="doTest()">
+    <div style="display: none;">
+      <object style="-moz-binding: url(#a);" data="about:blank"></object>
+    </div>
+  </body>
+</html>
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@ -171,5 +171,6 @@ HTTP load 1333001-1.html
 pref(dom.animations-api.core.enabled,true) load 1340344.html
 load 1342316-1.html
 load 1356601-1.html
+load 1370793-1.xhtml
 load content-only-on-link-before.html
 load content-only-on-visited-before.html