Bug 1861736 - crashtest r=emilio

Differential Revision: https://phabricator.services.mozilla.com/D192407
dothq · Jan 2, 2024 · 6c86f21 · 6c86f21
1 parent 2108f8b
commit 6c86f21
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 0 deletions.
diff --git a/dom/svg/crashtests/1861736.html b/dom/svg/crashtests/1861736.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<script>
+  document.addEventListener('DOMContentLoaded', async () => {
+    const svg = document.createElementNS('http://www.w3.org/2000/svg', 'svg')
+    const filter = document.createElementNS('http://www.w3.org/2000/svg', 'filter')
+    filter.setAttribute('id', 'id_0')
+    svg.appendChild(filter)
+    document.documentElement.appendChild(svg)
+    const doc = new Document()
+    const canvas = document.createElement('canvas')
+    const context = canvas.getContext('2d')
+    context.filter = 'url(#id_0)'
+    doc.adoptNode(document.documentElement)
+    SpecialPowers.gc()
+    setTimeout('self.close()', 2000)
+  })
+</script>
diff --git a/dom/svg/crashtests/crashtests.list b/dom/svg/crashtests/crashtests.list
@@ -98,3 +98,4 @@ load 1572904.html
 load 1683907.html
 pref(dom.svg.pathSeg.enabled,true) load 1715387.html
 load 1837487.html
+load 1861736.html