tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

pattern-with-invalid-base-cloned-thcrash.html (796B)

      1 <!DOCTYPE html>
      2 <script src="/resources/testharness.js"></script>
      3 <script src="/resources/testharnessreport.js"></script>
      4 <base id="base" href="invalid:">
      5 <svg id="svg">
      6  <pattern id="pat" xlink:href="#pat"/>
      7 </svg>
      8 <script>
      9  async_test(t => {
     10    onload = t.step_func_done(() => {
     11      let pattern = document.getElementById("pat");
     12      base.href = "";
     13      document.body.insertBefore(document.getElementById("svg").cloneNode(true),
     14                                 document.body.firstChild);
     15      document.body.offsetTop;
     16      pattern.setAttribute("clip-rule", "evenodd");
     17      document.body.offsetTop;
     18      pattern.setAttribute("width", "0");
     19      document.getElementById("svg").setAttribute("systemLanguage", "x-nonexistent");
     20      document.body.offsetTop;
     21    });
     22  });
     23 </script>