js/xpconnect/crashtests/453935-1.html

   1 <!DOCTYPE html>
   2 <html>
   3 <head>
   4 <script type="text/javascript">
   5
   6 function boom()
   7 {
   8   var a = [];
   9   a[31] = undefined;
  10   a[40] = undefined;
  11   a[44] = {};
  12   a[45] = new XMLHttpRequest();
  13   a[48] = new XMLHttpRequest();
  14   a[53] = XMLHttpRequest.prototype;
  15   a[53].__proto__ = {};
  16   a[53].nodeType = 100;
  17   search(a, 41);
  18 }
  19
  20
  21 function search(a, start)
  22 {
  23   var N = a.length;
  24
  25   for (var j = start; j < N; ++j) {
  26     var e = a[j];
  27     if (typeof e == "object" && "nodeType" in e && e.nodeType == 99)
  28       return j;
  29   }
  30
  31   return null;
  32 }
  33
  34 </script>
  35 </head>
  36 <body onload="boom();"></body>
  37 </html>