bug 375399 - crash test by Martijn Wargers.

2009-04-24 10:08:18 -07:00 · 2009-04-24 10:08:18 -07:00 · 85f6d7bbb6
--- a/dom/base/crashtests/375399-1-inner.xhtml
+++ b/dom/base/crashtests/375399-1-inner.xhtml
@ -0,0 +1,12 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:svg="http://www.w3.org/2000/svg">
+<svg:foreignObject x="0" y="0" width="100%" height="100%">
+<xul:tabs onselect="window.frameElement.parentNode.removeChild(window.frameElement)"><xul:tree id="t"/></xul:tabs>
+</svg:foreignObject>
+
+<html:script>
+function doe() {
+document.getElementById('t');
+}
+setTimeout(doe, 200);
+</html:script>
+</html>
--- a/dom/base/crashtests/375399-1.html
+++ b/dom/base/crashtests/375399-1.html
@ -0,0 +1,11 @@
+<html class="reftest-wait">
+<head>
+<title>Testcase bug 375399 - Crash [@ nsElementSH::PostCreate] when removing window when accessing xul:tree in xul:tabs onselect in svg:foreignObject</title>
+<script>
+setTimeout('document.documentElement.className = ""', 500);
+</script>
+</head>
+<body>
+<iframe id="content" src="./375399-1-inner.xhtml"></iframe>
+</body>
+</html>
--- a/dom/base/crashtests/crashtests.list
+++ b/dom/base/crashtests/crashtests.list
@ -11,6 +11,7 @@ load 369413-1.html
 load 371124-1.html
 load 371124-2.html
 load 372554-1.html
+load 375399-1.html
 load 404869-1.xul
 load 462947.html
 load 439206-1.html