tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

xpath-evaluate-crash.html (623B)

      1 <!DOCTYPE html>
      2 <meta charset="utf-8">
      3 <title>Evaluating XPath expressions with orhpaned Attr as context node doesn't crash</title>
      4 <link rel=author href="mailto:jarhar@chromium.org">
      5 <link rel=help href="https://bugs.chromium.org/p/chromium/issues/detail?id=1236967">
      6 <script src="/resources/testharnessreport.js"></script>
      7 <body>
      8 <script>
      9 for (const expression of [
     10    "..",
     11    "parent",
     12    "ancestor::*",
     13    "ancestor-or-self::*",
     14    "following::*",
     15    "preceding::*",
     16 ]) {
     17    const orphanedAttr = document.createAttribute("foo");
     18    new XPathEvaluator().evaluate(expression, orphanedAttr, null, 2);
     19 }
     20 </script>