Bug 1304948 - Part 3: Add testcase. r=rillian

MozReview-Commit-ID: DHT8B5ULA1i --HG-- extra : rebase_source : e880209682d8d16d8f10c5c85f6fe2ca1e503999
2016-09-29 17:46:52 +08:00 · 2016-09-29 17:46:52 +08:00 · 8d4c4d713c
--- a/dom/media/test/crashtests/1304948.html
+++ b/dom/media/test/crashtests/1304948.html
@ -0,0 +1,33 @@
+<html class="reftest-wait">
+<head>
+  <title> Bug 1304948 : Crash if a texttrack remove a cue not belongs to it. </title>
+</head>
+<meta charset="utf-8">
+<script type="text/javascript">
+
+window.onload = function() {
+  var a = document.createElementNS('http://www.w3.org/1999/xhtml', 'video');
+  a.src = "";
+  document.body.appendChild(a);
+  var b = a.addTextTrack('chapters', "AAAAAAAAAAAAAAAA", "de");
+  var c = new VTTCue(0.6, 0.3, "AA");
+  b.addCue(c);
+  var d = document.createElementNS('http://www.w3.org/1999/xhtml', 'video');
+  var e = d.addTextTrack('chapters', "AAAA", "en-US");
+  a.currentTime = 2;
+  a.play();
+  try {
+    // This will queue a TimeMarchesOn task on mainthread, so use
+    // timer to wait the TimeMarchesOn crash.
+    e.removeCue(c);
+  } catch (e) {
+    if (e.name == "NotFoundError") {
+      setTimeout(function() {
+        document.documentElement.removeAttribute("class");}, 0);
+	  }
+  }
+};
+
+</script>
+</body>
+</html>
--- a/dom/media/test/crashtests/crashtests.list
+++ b/dom/media/test/crashtests/crashtests.list
@ -82,6 +82,7 @@ skip-if(!B2G) load 1158427.html
 load 1185176.html
 load 1185192.html
 load 1228484.html
+load 1304948.html
 load analyser-channels-1.html
 load audiocontext-double-suspend.html
 load buffer-source-duration-1.html