dom/svg/crashtests/1715387.html

   1 <!DOCTYPE html>
   2 <html class="reftest-wait">
   3 <style>
   4 svg {
   5   width: 10%;
   6   height: 10%;
   7   background: #eee;
   8 }
   9 svg path {
  10   fill: none;
  11   stroke: #000;
  12 }
  13
  14 </style>
  15 <script>
  16   function run() {
  17     const target = document.createElementNS("http://www.w3.org/2000/svg", "path");
  18     const root = document.getElementById('svgroot');
  19     root.appendChild(target);
  20     target.style.d = 'path("M0,0 L2,2")';
  21
  22     var m = new MutationObserver(function () {
  23       // This will destroy the oringal document.
  24       document.write("<html><body></body></html>");
  25       SpecialPowers.forceGC();
  26       SpecialPowers.forceCC();
  27
  28       document.documentElement.classList.remove("reftest-wait");
  29     });
  30
  31     m.observe(target, { attributes: true });
  32     target.setAttribute("d", "none");
  33
  34     // Calling these APIs flushes the style, which may run the script in the
  35     // callback function above that destroys the composed document.
  36     target.getTotalLength();
  37     target.getPointAtLength(1);
  38     target.isPointInFill({x: 1, y: 1});
  39     target.isPointInStroke({x: 1, y: 1});
  40     target.getPathSegAtLength(0);
  41   }
  42 </script>
  43 <body onload="run()">
  44 <svg viewBox="0 0 20 20" id="svgroot">
  45 </svg>