test_valueLeaks.xhtml (2343B)
1 <html xmlns="http://www.w3.org/1999/xhtml"> 2 <!-- 3 https://bugzilla.mozilla.org/show_bug.cgi?id=467671 4 --> 5 <head> 6 <title>Test for Bug 467671</title> 7 <script src="/tests/SimpleTest/SimpleTest.js"></script> 8 <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/> 9 </head> 10 <body> 11 <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=467671">Mozilla Bug 467671</a> 12 <p id="display"></p> 13 <div id="content" style="display: none"> 14 15 </div> 16 <pre id="test"> 17 <script type="application/javascript"> 18 <![CDATA[ 19 20 /** Test for Bug 467671 */ 21 22 function storeSVGPropertyAsExpando(localName, prop) { 23 var elem = document.createElementNS("http://www.w3.org/2000/svg", localName); 24 25 elem.addEventListener("click", function() {}); 26 27 var propVal = elem[prop]; 28 Object.prototype.valueOf[prop + "_expando"] = propVal; 29 if (propVal instanceof SVGAnimatedAngle || propVal instanceof SVGAnimatedLength || 30 propVal instanceof SVGAnimatedRect || propVal instanceof SVGAnimatedPreserveAspectRatio) { 31 Object.prototype.valueOf[prop + "_baseVal_expando"] = propVal.baseVal; 32 Object.prototype.valueOf[prop + "_animVal_expando"] = propVal.animVal; 33 } 34 } 35 36 // class 37 storeSVGPropertyAsExpando("marker", "class"); 38 39 // angle 40 storeSVGPropertyAsExpando("marker", "orientAngle"); 41 42 // viewBox 43 storeSVGPropertyAsExpando("marker", "viewBox"); 44 45 // preserveAspectRatio 46 storeSVGPropertyAsExpando("marker", "preserveAspectRatio"); 47 48 // boolean 49 storeSVGPropertyAsExpando("feConvolveMatrix", "preserveAlpha"); 50 51 // enum 52 storeSVGPropertyAsExpando("feConvolveMatrix", "edgeMode"); 53 54 // special marker enum 55 storeSVGPropertyAsExpando("marker", "orientType"); 56 57 // integer 58 storeSVGPropertyAsExpando("feConvolveMatrix", "orderX"); 59 60 // length 61 storeSVGPropertyAsExpando("feConvolveMatrix", "x"); 62 63 // number 64 storeSVGPropertyAsExpando("feConvolveMatrix", "divisor"); 65 66 // string 67 storeSVGPropertyAsExpando("feConvolveMatrix", "in1"); 68 69 var elem1 = document.createElementNS("http://www.w3.org/2000/svg", "switch"); 70 var elem2 = document.createElementNS("http://www.w3.org/2000/svg", "rect"); 71 elem1.appendChild(elem2); 72 document.getElementById("content").appendChild(elem1); 73 74 elem2.addEventListener("click", function() {}); 75 76 Object.prototype.valueOf.expando = elem1; 77 78 ok(true, "SVG shouldn't leak."); 79 80 ]]> 81 </script> 82 </pre> 83 </body> 84 </html>