diff options
| author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-28 14:29:10 +0000 |
|---|---|---|
| committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-28 14:29:10 +0000 |
| commit | 2aa4a82499d4becd2284cdb482213d541b8804dd (patch) | |
| tree | b80bf8bf13c3766139fbacc530efd0dd9d54394c /editor/libeditor/crashtests | |
| parent | Initial commit. (diff) | |
| download | firefox-2aa4a82499d4becd2284cdb482213d541b8804dd.tar.xz firefox-2aa4a82499d4becd2284cdb482213d541b8804dd.zip | |
Adding upstream version 86.0.1.upstream/86.0.1upstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'editor/libeditor/crashtests')
140 files changed, 2943 insertions, 0 deletions
diff --git a/editor/libeditor/crashtests/1057677.html b/editor/libeditor/crashtests/1057677.html new file mode 100644 index 0000000000..d0b9497a5a --- /dev/null +++ b/editor/libeditor/crashtests/1057677.html @@ -0,0 +1,9 @@ +<html><body></body><script> +document.designMode = "on"; +var hrElem = document.createElement("HR"); +var select = window.getSelection(); +document.body.appendChild(hrElem); +select.collapse(hrElem,0); +document.execCommand("InsertHTML", false, "<div>foo</div><div>bar</div>"); +</script> +</html> diff --git a/editor/libeditor/crashtests/1128787.html b/editor/libeditor/crashtests/1128787.html new file mode 100644 index 0000000000..fc6bff0972 --- /dev/null +++ b/editor/libeditor/crashtests/1128787.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html> +<head> +<title>Bug 1128787</title> +</head> +<body> + <input type="button"/> + <script> + window.onload = function () { + document.designMode = "on"; + } + var input = document.getElementsByTagName("input")[0]; + input.focus(); + input.type = "text"; + </script> +</body> +</html> diff --git a/editor/libeditor/crashtests/1134545.html b/editor/libeditor/crashtests/1134545.html new file mode 100644 index 0000000000..4e871804ff --- /dev/null +++ b/editor/libeditor/crashtests/1134545.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<!-- saved from url=(0065)https://bug1134545.bugzilla.mozilla.org/attachment.cgi?id=8566418 --> +<html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"> +<script> + +function boom() +{ + textNode = document.createTextNode(" "); + x.appendChild(textNode); + x.setAttribute('contenteditable', "true"); + textNode.remove(); + window.getSelection().selectAllChildren(textNode); + document.execCommand("increasefontsize", false, null); +} + +</script> +</head> +<body onload="boom();"> +<div id="x" contenteditable="true"></div> + + +</body></html>
\ No newline at end of file diff --git a/editor/libeditor/crashtests/1158452.html b/editor/libeditor/crashtests/1158452.html new file mode 100644 index 0000000000..56c74abd61 --- /dev/null +++ b/editor/libeditor/crashtests/1158452.html @@ -0,0 +1,10 @@ + +<div> +<div> +aaaaaaa +</script> +<script type="text/javascript"> +document.designMode = "on" +window.getSelection().modify("extend", "backward", "line") +document.execCommand("increasefontsize","",null); +</script> diff --git a/editor/libeditor/crashtests/1158651.html b/editor/libeditor/crashtests/1158651.html new file mode 100644 index 0000000000..27278b5234 --- /dev/null +++ b/editor/libeditor/crashtests/1158651.html @@ -0,0 +1,18 @@ +<script> +onload = function() { + var testContainer = document.createElement("span"); + testContainer.contentEditable = true; + document.body.appendChild(testContainer); + + function queryFormatBlock(content) + { + testContainer.innerHTML = content; + while (testContainer.firstChild) + testContainer = testContainer.firstChild; + window.getSelection().collapse(testContainer, 0); + document.queryCommandValue('formatBlock'); + } + + queryFormatBlock('<ol>hello</ol>'); +}; +</script> diff --git a/editor/libeditor/crashtests/1244894.xhtml b/editor/libeditor/crashtests/1244894.xhtml new file mode 100644 index 0000000000..89a24751e9 --- /dev/null +++ b/editor/libeditor/crashtests/1244894.xhtml @@ -0,0 +1,21 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script> + +function boom() +{ + document.designMode = 'on'; + document.execCommand("indent", false, null); + document.execCommand("insertText", false, "a"); + document.execCommand("forwardDelete", false, null); + document.execCommand("justifyfull", false, null); +} + +window.addEventListener("load", boom, false); + +</script> +</head> + +<body> <span class="v"></span></body><body><input type="file" /></body> + +</html> diff --git a/editor/libeditor/crashtests/1264921.html b/editor/libeditor/crashtests/1264921.html new file mode 100644 index 0000000000..b53fcb5fd4 --- /dev/null +++ b/editor/libeditor/crashtests/1264921.html @@ -0,0 +1 @@ +<body style=display:table-footer-group onload=d=document;h=d.all[0];h.appendChild(d.createElement("input"));h.appendChild(d.createElement("iframe"));d.designMode="on">
\ No newline at end of file diff --git a/editor/libeditor/crashtests/1272490.html b/editor/libeditor/crashtests/1272490.html new file mode 100644 index 0000000000..2a8f1d9f9c --- /dev/null +++ b/editor/libeditor/crashtests/1272490.html @@ -0,0 +1,20 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="utf-8"> +<script> +window.onload = function () { + var childDocument = document.getElementsByTagName("iframe")[0].contentDocument; + childDocument.designMode = "on"; + function onAttrModified(aEvent) { + childDocument.removeEventListener("DOMAttrModified", onAttrModified); + // Remove the editor from document during executing "insertOrderedList". + document.body.innerHTML = ""; + } + childDocument.addEventListener("DOMAttrModified", onAttrModified); + childDocument.execCommand("insertOrderedList", false, "1"); +} +</script> +</head> +<body><iframe></iframe></body> +</html> diff --git a/editor/libeditor/crashtests/1274050.html b/editor/libeditor/crashtests/1274050.html new file mode 100644 index 0000000000..dc531fba57 --- /dev/null +++ b/editor/libeditor/crashtests/1274050.html @@ -0,0 +1,11 @@ +<body> +<table contenteditable="true"></table> +</body> +<script> +window.onload = function() { + document.execCommand("useCSS", false, false); + document.designMode = 'on'; + document.execCommand("insertunorderedlist", false); + document.execCommand("justifyfull", false); +}; +</script> diff --git a/editor/libeditor/crashtests/1317704.html b/editor/libeditor/crashtests/1317704.html new file mode 100644 index 0000000000..64359c796b --- /dev/null +++ b/editor/libeditor/crashtests/1317704.html @@ -0,0 +1,36 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="utf-8"> +<script> +addEventListener('DOMContentLoaded', function(){ + document.documentElement.className = 'lizard'; + setTimeout(function(){ + document.execCommand('selectAll', false, null); + document.designMode = 'on'; + document.execCommand('removeformat', false, null); + }, 0); +}); +</script> +<style> +.lizard{ + -webkit-user-select:all; +} +*{ + position:fixed; + display:table-column; +} +</style> +</head> +<body> +<span> +<span contenteditable> +<span class=lizard></span> +<span class=lizard></span> +<span /> +</span> +</span> +</span> +</span> +</body> +</html> diff --git a/editor/libeditor/crashtests/1317718.html b/editor/libeditor/crashtests/1317718.html new file mode 100644 index 0000000000..892b8aee31 --- /dev/null +++ b/editor/libeditor/crashtests/1317718.html @@ -0,0 +1,14 @@ +<!DOCTYPE html> +<html> +<script> +addEventListener('DOMContentLoaded', function() { + let root = document.documentElement; + while(root.firstChild) { + root.firstChild.remove(); + } + document.designMode = 'on'; + document.removeChild(document.documentElement); + document.execCommand('justifyleft', false, null); +}); +</script> +</html> diff --git a/editor/libeditor/crashtests/1324505.html b/editor/libeditor/crashtests/1324505.html new file mode 100644 index 0000000000..4872b9f05d --- /dev/null +++ b/editor/libeditor/crashtests/1324505.html @@ -0,0 +1,24 @@ +<!DOCTYPE html> +<html> +<script> +addEventListener("DOMContentLoaded", function(){ + let root = document.documentElement; + while(root.firstChild) { + root.firstChild.remove(); + } + let o_0 = document.createElement("body"); + root.appendChild(o_0); + o_0.appendChild(document.createElement("table")); + o_0.appendChild(document.createElement("canvas")); + let o_1 = document.createElement("canvas"); + o_0.appendChild(o_1); + o_1.setAttribute("contenteditable", "true"); + setTimeout(function(){ + document.execCommand("selectAll", false, "Marker felt"); + document.designMode = 'on'; + document.execCommand("insertorderedlist", false, null); + document.execCommand("insertorderedlist", false, null); + }, 0); +}); +</script> +</html> diff --git a/editor/libeditor/crashtests/1343918.html b/editor/libeditor/crashtests/1343918.html new file mode 100644 index 0000000000..24a3d9041f --- /dev/null +++ b/editor/libeditor/crashtests/1343918.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html> + <head> + <script type="application/javascript"> + let form = document.createElement('form'); + let input1 = document.createElement('input'); + let input2 = document.createElement('input'); + document.documentElement.appendChild(form); + document.documentElement.appendChild(input1); + form.appendChild(input2); + form.contentEditable = true + input1.focus(); + + let range = document.createRange(); + range.selectNode(input2); + window.getSelection().addRange(range); + document.execCommand("italic", false, null); + </script> + </head> + <body></body> +</html> diff --git a/editor/libeditor/crashtests/1344097.html b/editor/libeditor/crashtests/1344097.html new file mode 100644 index 0000000000..7f76957c5a --- /dev/null +++ b/editor/libeditor/crashtests/1344097.html @@ -0,0 +1,20 @@ +<html> + <head> + <script></script> + <script> + document.designMode = 'on'; + o1 = window.getSelection(); + o2 = document.createElement('code'); + o3 = document.createElement('style'); + o4 = document.createElement('style'); + document.head.appendChild(o3); + o1.modify("move", "right", "character"); + document.styleSheets[0].insertRule("* { position: absolute; }", 0); + document.head.appendChild(o4); + window.resizeTo(1,1); + document.documentElement.appendChild(o2); + o1.selectAllChildren(o2); + </script> + </head> + <body></body> +</html> diff --git a/editor/libeditor/crashtests/1345015.html b/editor/libeditor/crashtests/1345015.html new file mode 100644 index 0000000000..3781469578 --- /dev/null +++ b/editor/libeditor/crashtests/1345015.html @@ -0,0 +1,28 @@ +<!DOCTYPE html> +<html> + <head> + <script type="application/javascript"> + document.designMode = "on"; + let selection = window.getSelection(); + + let foo = document.createElement('foo'); + let div = document.createElement('div'); + document.documentElement.appendChild(foo); + document.documentElement.appendChild(div); + foo.outerHTML = '<foo>'; + + let range = document.createRange(); + range.selectNode(div); + selection.addRange(range); + range.setStart(foo, 0); + + range = document.createRange(); + range.selectNode(document.documentElement); + selection.addRange(range); + + document.execCommand('insertparagraph', false, null); + </script> + </head> + <body> + </body> +</html> diff --git a/editor/libeditor/crashtests/1348851.html b/editor/libeditor/crashtests/1348851.html new file mode 100644 index 0000000000..d618f049ee --- /dev/null +++ b/editor/libeditor/crashtests/1348851.html @@ -0,0 +1,19 @@ +<!DOCTYPE> +<html> +<head> +<meta charset="UTF-8"> +<script> +function boom(){ + document.designMode = "on"; + document.execCommand("insertlinebreak"); + document.designMode = "off"; + document.designMode = "on"; + document.execCommand("insertunorderedlist"); +} +addEventListener("DOMContentLoaded", boom); +</script> +</head> +<body style="display:flex;"> +<!--comment--> +</body> +</html> diff --git a/editor/libeditor/crashtests/1350772.html b/editor/libeditor/crashtests/1350772.html new file mode 100644 index 0000000000..e20481527d --- /dev/null +++ b/editor/libeditor/crashtests/1350772.html @@ -0,0 +1,16 @@ +<!DOCTYPE html> +<html> +<head> +<script> +addEventListener("DOMContentLoaded", () => { + try { + document.designMode = 'on'; + document.removeChild(document.documentElement); + document.appendChild(document.createElement("p")); + document.execCommand("insertParagraph", false, null); + } catch(e) { + } +}); +</script> +</head> +</html> diff --git a/editor/libeditor/crashtests/1364133.html b/editor/libeditor/crashtests/1364133.html new file mode 100644 index 0000000000..a1d06fba98 --- /dev/null +++ b/editor/libeditor/crashtests/1364133.html @@ -0,0 +1,42 @@ +<html> + <head> + <script> + var tr = document.createElement('tr'); + document.documentElement.appendChild(tr); + + var a1 = document.createElement('a'); + document.documentElement.appendChild(a1); + var a2 = document.createElement('a'); + tr.appendChild(a2); + + var a3 = document.createElement('a'); + document.documentElement.appendChild(a3); + + var a4 = document.createElement('a'); + document.documentElement.appendChild(a4); + + var a5 = document.createElement('a'); + a1.appendChild(a5); + + var input = document.createElement('input'); + document.documentElement.appendChild(input); + + a3.contentEditable = true; + a5.innerText = "xx"; + a4.outerHTML = ""; + input.select(); + + document.replaceChild(document.documentElement, document.documentElement); + window.find("x", false, false, false, false, false, false); + + var range = document.createRange(); + range.setStart(a1, 1); + window.getSelection().addRange(range); + + document.designMode = "on"; + + range.selectNode(a2); + document.execCommand("forecolor", false, "-moz-default-background-color"); + </script> + </head> +</html> diff --git a/editor/libeditor/crashtests/1366176.html b/editor/libeditor/crashtests/1366176.html new file mode 100644 index 0000000000..cf6841c650 --- /dev/null +++ b/editor/libeditor/crashtests/1366176.html @@ -0,0 +1,30 @@ +<html> +<head> + <script> + + function go() + { + try { o114 = document.createElement('canvas'); } catch(e) {;} + try { o103 = (new DOMParser).parseFromString('/', 'text/html'); } catch(e) {;} + try { o217 = o103.all[1]; } catch(e) {;} + try { o253 = window.getSelection(); } catch(e) {;} + + try { o270 = document.body.appendChild(document.createElement('a')); } catch(e) {;} + + try { o301 = window.getSelection(); } catch(e) {;} + try { o314 = window.getSelection(); } catch(e) {;} + try { document.body.appendChild(o114); } catch(e) {;} + try { document.documentElement.appendChild(o217); } catch(e) {;} + try { document.body.appendChild(o270); } catch(e) {;} + try { o217.contentEditable = true } catch(e) {;} + + try { o253.modify('move','forward','lineboundary'); } catch(e) {;} + try { o314.modify('extend','left','line'); } catch(e) {;} + try { o301.modify('extend','right','line'); } catch(e) {;} + } + </script> +</head> +<body onload="go();"> + <plaintext></plaintext> +</bdoy> +</html> diff --git a/editor/libeditor/crashtests/1375131.html b/editor/libeditor/crashtests/1375131.html new file mode 100644 index 0000000000..4060cf3d4c --- /dev/null +++ b/editor/libeditor/crashtests/1375131.html @@ -0,0 +1,33 @@ +<!DOCTYPE html> +<html> + <head> + <script type="application/javascript"> + document.designMode = 'on'; + + let div = document.createElement('div'); + let p = document.createElement('p'); + document.documentElement.appendChild(div); + document.documentElement.appendChild( + document.createElement('body')); + document.documentElement.appendChild(p); + document.execCommand('insertimage', false, 'http://localhost/'); + document.execCommand('insertparagraph', false, null); + + document.elementFromPoint(0, 0); + + let selection = window.getSelection(); + selection.modify('extend', 'forward', 'character'); + + let range = document.createRange(); + range.selectNode(p); + selection.addRange(range); + range.setStart(div, 0); + + range = document.createRange(); + range.selectNode(p); + selection.addRange(range); + + document.execCommand('delete', false, null); + </script> + </head> +</html> diff --git a/editor/libeditor/crashtests/1381541.html b/editor/libeditor/crashtests/1381541.html new file mode 100644 index 0000000000..8902e3d032 --- /dev/null +++ b/editor/libeditor/crashtests/1381541.html @@ -0,0 +1,20 @@ +<!DOCTYPE html> +<html> + <head> + <script type="application/javascript"> + var editable = document.createElement('div'); + document.documentElement.appendChild(editable); + editable.contentEditable = 'true'; + var div = document.createElement('div'); + document.documentElement.appendChild(div); + // Flush content + div.offsetLeft; + document.execCommand('styleWithCSS', false, true); + + var range = new Range(); + window.getSelection().addRange(range); + range.setStart(document.createTextNode(''), 0); + document.queryCommandState('backcolor'); + </script> + </head> +</html> diff --git a/editor/libeditor/crashtests/1383747.html b/editor/libeditor/crashtests/1383747.html new file mode 100644 index 0000000000..1c926cc7ea --- /dev/null +++ b/editor/libeditor/crashtests/1383747.html @@ -0,0 +1,15 @@ +<html> + <head> + <script> + try { o1 = window.getSelection() } catch(e) { } + try { o2 = document.createElement('map') } catch(e) { }; + try { o3 = document.createElement('select') } catch(e) { } + try { document.documentElement.appendChild(o2) } catch(e) { }; + try { o2.contentEditable = 'true' } catch(e) { }; + try { o2.offsetTop } catch(e) { }; + try { document.replaceChild(document.implementation.createHTMLDocument().documentElement, document.documentElement); } catch(e) { } + try { document.documentElement.appendChild(o3) } catch(e) { } + try { o1.modify('extend', 'forward', 'word') } catch(e) { } + </script> + </head> +</html>
\ No newline at end of file diff --git a/editor/libeditor/crashtests/1383755.html b/editor/libeditor/crashtests/1383755.html new file mode 100644 index 0000000000..3cbfe08d17 --- /dev/null +++ b/editor/libeditor/crashtests/1383755.html @@ -0,0 +1,26 @@ +<html> + <head> + <script type="application/javascript"> + let table = document.createElement('table'); + document.documentElement.appendChild(table); + let tr = document.createElement('tr'); + table.appendChild(tr); + let input = document.createElement('input'); + document.documentElement.appendChild(input); + + let img = document.createElement('img'); + input.appendChild(img); + img.contentEditable = 'true' + tr.appendChild(img); + img.offsetParent; + + // Since table's cell is selected by the following, it will show + // object resizer that is anonymous element. + window.getSelection().selectAllChildren(tr); + // Document.adoptNode will remove anonymous element of object resizer + // and it shouldn't cause crash + document.implementation.createDocument('', '').adoptNode(table); + </script> + </head> +</html> + diff --git a/editor/libeditor/crashtests/1383763.html b/editor/libeditor/crashtests/1383763.html new file mode 100644 index 0000000000..a97d685368 --- /dev/null +++ b/editor/libeditor/crashtests/1383763.html @@ -0,0 +1,17 @@ +<xsl:stylesheet id='xsl'> +<script id='script'> +try { o1 = document.createElement('table') } catch(e) { } +try { o3 = document.createElement('area') } catch(e) { } +try { o4 = document.createElement('script'); } catch(e) { } +try { o5 = document.getSelection() } catch(e) { } +try { document.implementation.createDocument('', '', null).adoptNode(o1); } catch(e) { } +try { o1.appendChild(o3) } catch(e) { } +try { o5.addRange(new Range()); } catch(e) { } +try { document.documentElement.appendChild(o4) } catch(e) { } +try { o4.textContent = 'XX' } catch(e) { } +try { o7 = o4.firstChild } catch(e) { } +try { o4.parentNode.insertBefore(o7, o4); } catch(e) { } +try { o5.modify('extend', 'forward', 'line') } catch(e) { } +try { o5.selectAllChildren(o3) } catch(e) { } +try { o7.splitText(1) } catch(e) { } +</script>
\ No newline at end of file diff --git a/editor/libeditor/crashtests/1384161.html b/editor/libeditor/crashtests/1384161.html new file mode 100644 index 0000000000..c7d8ccc292 --- /dev/null +++ b/editor/libeditor/crashtests/1384161.html @@ -0,0 +1,17 @@ +<html> + <head> + <script> + try { o1 = document.createElement('caption') } catch(e) { } + try { o2 = document.createElement('select') } catch(e) { } + try { o3 = document.createElement('map') } catch(e) { } + try { o4 = window.getSelection() } catch(e) { } + try { document.documentElement.appendChild(o1) } catch(e) { } + try { o1.style.display = 'contents' } catch(e) { } + try { document.prepend(o2, document) } catch(e) { } + try { document.designMode = 'on'; } catch(e) { } + try { o3.ownerDocument.execCommand('outdent', false, null) } catch(e) { } + try { document.designMode = 'off'; } catch(e) { } + try { o4.extend(o2, 0) } catch(e) { } + </script> + </head> +</html>
\ No newline at end of file diff --git a/editor/libeditor/crashtests/1388075.html b/editor/libeditor/crashtests/1388075.html new file mode 100644 index 0000000000..057c97c4b3 --- /dev/null +++ b/editor/libeditor/crashtests/1388075.html @@ -0,0 +1,23 @@ +<html> + <head> + <script> + try { o1 = document.createElement('style'); } catch(e) { } + try { o2 = document.createElement('output') } catch(e) { } + try { o3 = document.createElement('input') } catch(e) { } + try { o4 = document.createElement('script'); } catch(e) { } + try { o5 = o2.cloneNode(false); } catch(e) { } + try { document.documentElement.appendChild(o1) } catch(e) { } + try { o1.outerHTML = '<a contenteditable=\'true\'>'; } catch(e) { } + try { document.documentElement.appendChild(o3) } catch(e) { } + try { o7 = document.createTextNode(' '); } catch(e) { } + try { o4.appendChild(o7) } catch(e) { } + try { document.documentElement.appendChild(o4) } catch(e) { } + try { o6 = window.getSelection() } catch(e) { } + try { o3.select() } catch(e) { } + try { document.replaceChild(document.documentElement, document.documentElement); } catch(e) { } + try { o6.setBaseAndExtent(o7, 0, o5, 0) } catch(e) { } + try { document.designMode = 'on'; } catch(e) { } + try { document.execCommand('insertimage', false, 'http://localhost/') } catch(e) { } + </script> + </head> +</html> diff --git a/editor/libeditor/crashtests/1393171.html b/editor/libeditor/crashtests/1393171.html new file mode 100644 index 0000000000..0aca3304e7 --- /dev/null +++ b/editor/libeditor/crashtests/1393171.html @@ -0,0 +1,10 @@ +<script> +window.onload=function(){ + window.getSelection().addRange(document.createRange()); + document.getElementById('a').appendChild(document.createElement('option')); + window.getSelection().modify('extend','backward','lineboundary'); +} +</script> +<div></div> +<textarea autofocus='true'></textarea> +<del id='a'> diff --git a/editor/libeditor/crashtests/1402196.html b/editor/libeditor/crashtests/1402196.html new file mode 100644 index 0000000000..6867d36414 --- /dev/null +++ b/editor/libeditor/crashtests/1402196.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<head> +<script> +function load() { + document.getElementById("spacer").addEventListener("DOMNodeInserted", () => { + document.getElementById("style").appendChild( + document.getElementById("table")); + document.documentElement.classList.remove("reftest-wait"); + }); + document.execCommand("insertOrderedList", false); +} +</script> +</head> +<body onload="load()"> +<table id="table"></table> +<style id="style"></style> +<spacer id="spacer" contenteditable="true"> +<p id="p"></p> +</body> +</html> diff --git a/editor/libeditor/crashtests/1402469.html b/editor/libeditor/crashtests/1402469.html new file mode 100644 index 0000000000..04b1adc96f --- /dev/null +++ b/editor/libeditor/crashtests/1402469.html @@ -0,0 +1,16 @@ +<html> +<head> +<script type="application/javascript"> +function do_test() { + document.execCommand("insertUnorderedList", false); +} +</script> +</head> +<body onload="do_test()"> +<table> + <th contenteditable="true"> + <ol contenteditable="false"> + </th> +</table> +</body> +</html> diff --git a/editor/libeditor/crashtests/1402526.html b/editor/libeditor/crashtests/1402526.html new file mode 100644 index 0000000000..4d6077d995 --- /dev/null +++ b/editor/libeditor/crashtests/1402526.html @@ -0,0 +1,14 @@ +<script>
+function jsfuzzer() {
+ try { var var00007 = eventhandler5; } catch(e) { }
+ try { var var00006 = var00007; } catch(e) { }
+ try { htmlvar00007.addEventListener("DOMNodeInserted", var00006); } catch(e) { }
+ try { document.execCommand("justifyFull", false); } catch(e) { }
+}
+function eventhandler5() {
+ try { htmlvar00008.replaceWith("1"); } catch(e) { }
+}
+</script>
+<body onload=jsfuzzer()>
+<dd id="htmlvar00007" contenteditable="true">
+<shadow id="htmlvar00008">
\ No newline at end of file diff --git a/editor/libeditor/crashtests/1402904.html b/editor/libeditor/crashtests/1402904.html new file mode 100644 index 0000000000..96880ce4a3 --- /dev/null +++ b/editor/libeditor/crashtests/1402904.html @@ -0,0 +1,31 @@ +<script> +function jsfuzzer() { + var option = document.getElementById("option"); + option.addEventListener("click", () => { + document.execCommand("forwardDelete", false); + }); + var li2 = document.getElementById("li2"); + li2.addEventListener("DOMNodeInserted", () => { + option.click(); + }); + var select = document.getElementById("select"); + select.parentElement.setAttribute("onpageshow", "onPageShow()"); +} + +function onPageShow() { + var li1 = document.getElementById("li1"); + li1.addEventListener("DOMSubtreeModified", () => { + document.execCommand("selectAll", false); + document.execCommand("indent", false); + }); + li1.appendChild(document.createElement("legend")); +} +</script> +<body onload=jsfuzzer()> +<select id="select"> +<option id="option"></option> +</select> +<li id="li1"></li> +<ul contenteditable="true"> +<li id="li2"></li> +<embed>a;#2 diff --git a/editor/libeditor/crashtests/1405747.html b/editor/libeditor/crashtests/1405747.html new file mode 100644 index 0000000000..38923228db --- /dev/null +++ b/editor/libeditor/crashtests/1405747.html @@ -0,0 +1,23 @@ +<script> +var target; +function jsfuzzer() { +target = htmlvar00017; // Cache the target for removing the event handler. +try { target.addEventListener("DOMSubtreeModified", eventhandler5); } catch(e) { } +try { target.align = ""; } catch(e) { } +} +var count = 0; +function eventhandler5() { +if (count++ == 1) { + // If we didn't stop testing this, this event handler would be called too + // many times. It's enough to run twice to reproduce the bug report. + target.removeEventListener("DOMSubtreeModified", eventhandler5); +} +try { document.execCommand("selectAll", false); } catch(e) { } +try { document.execCommand("justifyCenter", false); } catch(e) { } +try { document.execCommand("forwardDelete", false); } catch(e) { } +} +</script> +<body onload=jsfuzzer()> +<table contenteditable=""> +<th id="htmlvar00017"></th> +<colgroup>
\ No newline at end of file diff --git a/editor/libeditor/crashtests/1405897.html b/editor/libeditor/crashtests/1405897.html new file mode 100644 index 0000000000..c5c60bc6cf --- /dev/null +++ b/editor/libeditor/crashtests/1405897.html @@ -0,0 +1,16 @@ +<style> +* { position: absolute; } +</style> +<script> +function jsfuzzer() { + del1.addEventListener("DOMSubtreeModified", () => { + document.execCommand("italic", false); + document.execCommand("selectAll", false); + }); + a1.replaceChild(iframe1, a1.childNodes[0]); +} +</script> +<body onload=jsfuzzer()> +<a contenteditable="" id="a1"> +<del id="del1"> +<iframe id="iframe1"> diff --git a/editor/libeditor/crashtests/1408170.html b/editor/libeditor/crashtests/1408170.html new file mode 100644 index 0000000000..cc05a45e68 --- /dev/null +++ b/editor/libeditor/crashtests/1408170.html @@ -0,0 +1,20 @@ +<script> +function jsfuzzer() { + try { document.execCommand("insertUnorderedList", false); } catch(e) { } + try { document.execCommand("delete", false); } catch(e) { } +} +function eventhandler1() { + try { window.getSelection().collapse(htmlvar00001,1); } catch(e) { } +} +function eventhandler2() { + try { htmlvar00002.appendChild(htmlvar00001); } catch(e) { } +} +</script> +<body onload=jsfuzzer()> +<label id="htmlvar00002" contenteditable="true"> +<details ontoggle="eventhandler2()" open="true"> +</details> +</label> +<details ontoggle="eventhandler1()" open="true"> +<font id="htmlvar00001" dir="rtl"> +<summary> diff --git a/editor/libeditor/crashtests/1414581.html b/editor/libeditor/crashtests/1414581.html new file mode 100644 index 0000000000..17cdc2f8c8 --- /dev/null +++ b/editor/libeditor/crashtests/1414581.html @@ -0,0 +1,31 @@ +<!DOCTYPE html>
+<html>
+<head>
+<script>
+function jsfuzzer() {
+ document.execCommand("outdent", false);
+}
+function eventhandler2() {
+ document.execCommand("styleWithCSS", false, true);
+}
+function eventhandler3() {
+ document.execCommand("delete", false);
+ var element1 = document.getElementById("element1");
+ document.getSelection().setPosition(element1, 0);
+ var element1 = document.getElementById("element2");
+ element2.ownerDocument.execCommand("insertOrderedList", false);
+ var element1 = document.getElementById("element3");
+ element3.addEventListener("DOMSubtreeModified", eventhandler3);
+ document.activeElement.setAttribute("contenteditable", "true");
+}
+</script>
+</head>
+<body onload=jsfuzzer()>
+<i id="element1">
+<audio i src="x"></audio>
+<da id="element2">
+<br id="element3" style="">
+<svg onload="eventhandler3()">
+<animate onbegin="eventhandler2()">
+<body>
+</html>
diff --git a/editor/libeditor/crashtests/1415231.html b/editor/libeditor/crashtests/1415231.html new file mode 100644 index 0000000000..4878d7b7cc --- /dev/null +++ b/editor/libeditor/crashtests/1415231.html @@ -0,0 +1,17 @@ +<script> +function jsfuzzer() { + var var00043 = window.getSelection(); + htmlvar00018.addEventListener("DOMNodeRemoved", eh1); + var00043.setPosition(htmlvar00016); + document.execCommand("insertText", false, "1"); +} +function eh1() { + document.execCommand("insertHorizontalRule", false); + document.execCommand("justifyCenter", false); +} +</script> +<body onload=jsfuzzer()> +<li contenteditable="true"> +<shadow id="htmlvar00016"> +<ins id="htmlvar00018"> +<option> diff --git a/editor/libeditor/crashtests/1423767.html b/editor/libeditor/crashtests/1423767.html new file mode 100644 index 0000000000..c786e5af5a --- /dev/null +++ b/editor/libeditor/crashtests/1423767.html @@ -0,0 +1,13 @@ +<script> +function go() { + document.getElementById("label1").addEventListener("DOMNodeRemoved", () => { + document.getElementById("a1").innerText = ""; + }); + document.execCommand("indent", false); +} +</script> +<body onload=go()> +<li contenteditable=""> +<a id="a1"> +<label id="label1"></br> +<!--- diff --git a/editor/libeditor/crashtests/1423776.html b/editor/libeditor/crashtests/1423776.html new file mode 100644 index 0000000000..dce0fe2f74 --- /dev/null +++ b/editor/libeditor/crashtests/1423776.html @@ -0,0 +1,15 @@ +<script> +function go() { + svgvar00002.addEventListener("DOMNodeInserted", () => { + svg.appendChild(svgvar00008); + document.execCommand("insertOrderedList", false); + }); + svgvar00002.insertAdjacentHTML("afterBegin", table.outerHTML); +} +</script> +<body onload=go()> +<table id="table"></table> +<b contenteditable="true"> +<svg id="svg"> +<feConvolveMatrix id="svgvar00002"/> +<feConvolveMatrix id="svgvar00008"/> diff --git a/editor/libeditor/crashtests/1424450.html b/editor/libeditor/crashtests/1424450.html new file mode 100644 index 0000000000..cfb050148c --- /dev/null +++ b/editor/libeditor/crashtests/1424450.html @@ -0,0 +1,29 @@ +<script> +function go() { + let selection = window.getSelection(); + selection.setPosition(htmlvar00007, 1); + selection.setBaseAndExtent(htmlvar00011, 0, htmlvar00043, 0); + svgvar00014.before(svgvar00008.previousElementSibling); + + document.execCommand("removeFormat", false); + document.execCommand("hiliteColor", false, "-moz-buttondefault"); + document.execCommand("insertText", false, ""); +} +function eh1() { + svgvar00007.appendChild(htmlvar00011); + htmlvar00003.appendChild(htmlvar00035); +} +</script> +<body onload=go()> +<span id="htmlvar00003"> +<pre id="htmlvar00007" contenteditable="true"> +<fieldset id="htmlvar00011"></fieldset> +<iframe srcdoc="H"></iframe> +<a id="htmlvar00035" hidden="hidden" contenteditable="true"> +<svg> +<set onbegin="eh1()"/> +<use id="htmlvar00043"> +<desc id="svgvar00007"></desc> +</use> +<font-face-uri id="svgvar00008"/> +<feComponentTransfer id="svgvar00014"> diff --git a/editor/libeditor/crashtests/1425091.html b/editor/libeditor/crashtests/1425091.html new file mode 100644 index 0000000000..b4ab8cc2ef --- /dev/null +++ b/editor/libeditor/crashtests/1425091.html @@ -0,0 +1,15 @@ +<script> +function go() { + document.scrollingElement.addEventListener("DOMNodeInserted", () => { + document.execCommand("selectAll", false); + document.execCommand("insertOrderedList", false); + }); + a.appendChild(document.createElement("e")); +} +</script> +<body onload=go()> +<meter contenteditable="true"> +<dialog> +<style id="a"></style> +</dialog> +</meter> diff --git a/editor/libeditor/crashtests/1426709.html b/editor/libeditor/crashtests/1426709.html new file mode 100644 index 0000000000..c6f1d712ac --- /dev/null +++ b/editor/libeditor/crashtests/1426709.html @@ -0,0 +1,17 @@ +<script> +function go() { + a.setAttribute("contenteditable", "true"); + b.addEventListener("DOMNodeRemoved", eh); + b.appendChild(c); +} +function eh() { + document.body.appendChild(b); + document.execCommand("justifyFull", false); + document.execCommand("delete", false); +} +</script> +<body onload=go()> +<li id="a"> +A +<pre id="b" contenteditable="true"> +<input autofocus="autofocus" id="c"> diff --git a/editor/libeditor/crashtests/1441619.html b/editor/libeditor/crashtests/1441619.html new file mode 100644 index 0000000000..08343feeed --- /dev/null +++ b/editor/libeditor/crashtests/1441619.html @@ -0,0 +1,12 @@ +<html> + <head> + <script> + try { o1 = window.getSelection() } catch (e) {} + try { o2 = document.createRange() } catch (e) {} + try { document.head.replaceWith('', document.documentElement) } catch (e) {} + try { o1.addRange(o2) } catch (e) {} + try { document.designMode = 'on' } catch (e) {} + try { o1.focusNode.execCommand('justifyleft', false, null) } catch (e) {} + </script> + </head> +</html> diff --git a/editor/libeditor/crashtests/1443664.html b/editor/libeditor/crashtests/1443664.html new file mode 100644 index 0000000000..033d1a979a --- /dev/null +++ b/editor/libeditor/crashtests/1443664.html @@ -0,0 +1,10 @@ +<style> +input:focus { counter-increment: c; } +</style> +<script> +function go() { + a.select(); +} +</script> +<body onload=go()> +<input id="a" type="number" contenteditable="true"> diff --git a/editor/libeditor/crashtests/1444630.html b/editor/libeditor/crashtests/1444630.html new file mode 100644 index 0000000000..4c86cf39a6 --- /dev/null +++ b/editor/libeditor/crashtests/1444630.html @@ -0,0 +1,27 @@ +<!DOCTYPE HTML> +<html class="reftest-wait"> +<head> +<script type="text/javascript"> +function load() +{ + let textarea = document.getElementById("editor"); + textarea.focus(); + + SpecialPowers.Cu.import("resource://reftest/AsyncSpellCheckTestHelper.jsm") + .onSpellCheck(textarea, () => { + let isc = SpecialPowers.wrap(textarea).editor.getInlineSpellChecker(false); + let sc = isc.spellChecker; + + textarea.setAttribute("lang", "en-US"); + sc.UpdateCurrentDictionary(() => { + document.documentElement.classList.remove("reftest-wait"); + }); + sc.UninitSpellChecker(); + }); +} +</script> +</head> +<body onload="load()"> +<textarea id="editor" spellchecker="true">ABC</textarea> +</body> +</html> diff --git a/editor/libeditor/crashtests/1446451.html b/editor/libeditor/crashtests/1446451.html new file mode 100644 index 0000000000..35e6771785 --- /dev/null +++ b/editor/libeditor/crashtests/1446451.html @@ -0,0 +1,8 @@ +<script> +function go() { + document.execCommand("insertImage", false, "o") +} +</script> +<body onload=go()> +<meter contenteditable="true"> +<dialog> diff --git a/editor/libeditor/crashtests/1464251.html b/editor/libeditor/crashtests/1464251.html new file mode 100644 index 0000000000..72ec255117 --- /dev/null +++ b/editor/libeditor/crashtests/1464251.html @@ -0,0 +1,21 @@ +<script> +var count = 0; + +function go() { + document.execCommand("delete", false); +} +function eh() { + count++; + if (count >= 3) { + return; + } + window.addEventListener("DOMNodeInserted", eh); + document.execCommand("removeFormat", false); + document.execCommand("insertText", false, "1"); +} +</script> +<body onload=go()> +<ol oninput="eh()" contenteditable="true"> +<!-- x --> +<s> +<!-- x --> diff --git a/editor/libeditor/crashtests/1470926.html b/editor/libeditor/crashtests/1470926.html new file mode 100644 index 0000000000..9c39710a97 --- /dev/null +++ b/editor/libeditor/crashtests/1470926.html @@ -0,0 +1,9 @@ +<script> +function go() { + a.select(); + a.setAttribute("hidden", ""); + a.setRangeText("f"); +} +</script> +<body onload=go()> +<textarea id="a">-</textarea> diff --git a/editor/libeditor/crashtests/1474978.html b/editor/libeditor/crashtests/1474978.html new file mode 100644 index 0000000000..c7009f5970 --- /dev/null +++ b/editor/libeditor/crashtests/1474978.html @@ -0,0 +1,14 @@ +<script> +function go() { + document.getSelection().setPosition(b); + a.addEventListener("DOMNodeInserted", eh); + document.execCommand("insertImage", false, "#"); +} +function eh() { + document.execCommand("selectAll", false); + document.execCommand("insertText", false, ""); +} +</script> +<body onload=go()> +<dd id="a" contenteditable="true"> +<template id="b"></template> diff --git a/editor/libeditor/crashtests/1525481.html b/editor/libeditor/crashtests/1525481.html new file mode 100644 index 0000000000..4782609603 --- /dev/null +++ b/editor/libeditor/crashtests/1525481.html @@ -0,0 +1,19 @@ +<script> +function go() { + document.execCommand("styleWithCSS", false, true) + document.execCommand("delete", false) + a.addEventListener("DOMNodeRemoved", function() { + var c = window.getSelection() + var d = document.createRange() + d.setEndAfter(b) + c.addRange(d) + c.deleteFromDocument() + }) + document.execCommand("outdent", false) +} +</script> +<body onload=go()> +<ul id="a" contenteditable="true" style="margin: -1px 0px 1px 6px"> +<dd></dd> +<dd> +<button id="b">
\ No newline at end of file diff --git a/editor/libeditor/crashtests/1533913.html b/editor/libeditor/crashtests/1533913.html new file mode 100644 index 0000000000..81040c91f4 --- /dev/null +++ b/editor/libeditor/crashtests/1533913.html @@ -0,0 +1,14 @@ +<script> +function go() { + document.execCommand("justifyFull", false) + document.execCommand("selectAll", false) + window.top.addEventListener("DOMNodeRemoved", eh) + document.execCommand("heading", false, "H1") +} +function eh() { + document.execCommand("insertHTML", false, undefined) +} +</script> +<body onload=go()> +<dd contenteditable="true">A +<!-- A --> diff --git a/editor/libeditor/crashtests/1534394.html b/editor/libeditor/crashtests/1534394.html new file mode 100644 index 0000000000..c254aa5f52 --- /dev/null +++ b/editor/libeditor/crashtests/1534394.html @@ -0,0 +1,29 @@ +<html> +<head> + <script> + + function start () { + const sel = document.getSelection() + const range_1 = new Range() + const noscript = document.getElementById('id_24') + const map = document.getElementById('id_26') + sel.selectAllChildren(noscript) + const range_2 = range_1.cloneRange() + range_2.selectNode(map) + const frag = range_2.extractContents() + range_2.insertNode(noscript) + document.documentElement.contentEditable = true + document.execCommand('removeFormat', false,) + noscript.contentEditable = false + document.execCommand('insertText', false, '�\n') + } + + window.addEventListener('load', start) + </script> +</head> +<body> +<big class=""> + <map class="" id="id_26"> + <noscript class="" id="id_24"> +</body> +</html> diff --git a/editor/libeditor/crashtests/1547897.html b/editor/libeditor/crashtests/1547897.html new file mode 100644 index 0000000000..bf5c81060a --- /dev/null +++ b/editor/libeditor/crashtests/1547897.html @@ -0,0 +1,17 @@ +<html> +<head> + <script> + function start () { + const selection = window.getSelection() + selection.setPosition(hr, 0) + document.execCommand('delete', false) + } + </script> +<body onload="start()"> +<p id="" hidden=""> + <canvas id="" contenteditable=""> + <hr id="hr" contenteditable="true"> + 3uW4*</hr></canvas> +</p> +</body> +</html> diff --git a/editor/libeditor/crashtests/1547898.html b/editor/libeditor/crashtests/1547898.html new file mode 100644 index 0000000000..696e429e0b --- /dev/null +++ b/editor/libeditor/crashtests/1547898.html @@ -0,0 +1,16 @@ +<html> +<head> + <script> + function jsfuzzer () { + window.find('1') + const selection = window.getSelection() + selection.extend(document.getElementById('list_item')) + document.getElementById('list_item').contentEditable = 'true' + document.execCommand('indent', false) + } + </script> +</head> +<body onload=jsfuzzer()> +<li id="list_item">16</li> +</body> +</html> diff --git a/editor/libeditor/crashtests/1556799.html b/editor/libeditor/crashtests/1556799.html new file mode 100644 index 0000000000..c83fcd618d --- /dev/null +++ b/editor/libeditor/crashtests/1556799.html @@ -0,0 +1,11 @@ +<script> +function go() { + document.getSelection().selectAllChildren(a) + document.execCommand("insertUnorderedList", false) + document.execCommand("enableObjectResizing", false) +} +</script> +<dd contenteditable="true"> +<audio src="data:text/html,foo" onerror="go()"> +<img id="a"></img> +<dl> diff --git a/editor/libeditor/crashtests/1574544.html b/editor/libeditor/crashtests/1574544.html new file mode 100644 index 0000000000..32dc2dbf3c --- /dev/null +++ b/editor/libeditor/crashtests/1574544.html @@ -0,0 +1,12 @@ +<style> +* { display: table-caption } +body { display: contents } +</style> +<script> +function go() { + document.execCommand("enableInlineTableEditing", false) +} +</script> +<body onload=go()> +<table contenteditable="true"> +<th> diff --git a/editor/libeditor/crashtests/1578916.html b/editor/libeditor/crashtests/1578916.html new file mode 100644 index 0000000000..08883f0c95 --- /dev/null +++ b/editor/libeditor/crashtests/1578916.html @@ -0,0 +1,15 @@ +<script>
+function go() {
+ b.appendChild(document.body.firstChild)
+ document.getSelection().setBaseAndExtent(c.appendChild(b),0,b,1)
+ a.addEventListener("DOMCharacterDataModified", function() {
+ window.getSelection().removeAllRanges()
+ })
+ document.execCommand("delete", false)
+}
+</script>
+<body onload=go()>
+<audio id="a">
+<li contenteditable="true">
+<data id="c">
+<source id="b">
diff --git a/editor/libeditor/crashtests/1579934.html b/editor/libeditor/crashtests/1579934.html new file mode 100644 index 0000000000..580e1a83bb --- /dev/null +++ b/editor/libeditor/crashtests/1579934.html @@ -0,0 +1,19 @@ +<html id="a"><script type="text/javascript" id="__gaOptOutExtension">window["_gaUserPrefs"] = { ioo : function() { return true; } }</script><head>
+<meta http-equiv="content-type" content="text/html; charset=windows-1252"><script>
+function go() {
+ b.addEventListener("DOMCharacterDataModified", () => {
+ a.appendChild(b)
+ })
+ document.execCommand("delete", false)
+}
+function eh() {
+ b.reset()
+}
+</script>
+</head><body onload="go()">
+<details ontoggle="eh()" open="">
+<dt contenteditable="">
+</dt>
+</details><aside style="position: fixed; top: 0px; right: 0px; font-family: "Lucida Console", monospace; background-color: rgb(242, 230, 217); padding: 3px; z-index: 10000; text-align: center; max-width: 120px; opacity: 0; transition: opacity 0.5s linear 0s;">1194 x 73</aside></body><form id="b"><keygen>
+<button autofocus="">
+</button></form></html>
\ No newline at end of file diff --git a/editor/libeditor/crashtests/1581246.html b/editor/libeditor/crashtests/1581246.html new file mode 100644 index 0000000000..f98c806b9f --- /dev/null +++ b/editor/libeditor/crashtests/1581246.html @@ -0,0 +1,11 @@ +<script id="a">
+function go() {
+ a.appendChild(b)
+ document.execCommand("indent", false)
+ document.execCommand("delete", false)
+}
+</script>
+<body onload=go()>
+<ul contenteditable="true">
+<li id="b" contenteditable="false">
+<textarea autofocus>
diff --git a/editor/libeditor/crashtests/1596516.html b/editor/libeditor/crashtests/1596516.html new file mode 100644 index 0000000000..37b9c5889c --- /dev/null +++ b/editor/libeditor/crashtests/1596516.html @@ -0,0 +1,18 @@ +<html> +<head> + <script> + function start () { + const italic = document.createElementNS('http://www.w3.org/1999/xhtml', 'i') + italic.dir = '' + document.documentElement.contentEditable = 'true' + const selection = document.getSelection() + const range = selection.getRangeAt(0) + const attribute = italic.attributes.getNamedItem('dir') + range.setEnd(attribute, (2361162229 % attribute.childNodes)) + document.queryCommandState('heading') + } + + document.addEventListener('DOMContentLoaded', start) + </script> +</head> +</html> diff --git a/editor/libeditor/crashtests/1605741.html b/editor/libeditor/crashtests/1605741.html new file mode 100644 index 0000000000..d532780692 --- /dev/null +++ b/editor/libeditor/crashtests/1605741.html @@ -0,0 +1,9 @@ +<script> +window.onload = () => { + a.addEventListener("DOMNodeRemoved", () => { + document.getSelection().collapse(document.getElementById("")) + }) + document.execCommand("delete", false) +} +</script> +<div id="a" contenteditable>x</link>
\ No newline at end of file diff --git a/editor/libeditor/crashtests/1613521.html b/editor/libeditor/crashtests/1613521.html new file mode 100644 index 0000000000..7d59667559 --- /dev/null +++ b/editor/libeditor/crashtests/1613521.html @@ -0,0 +1,16 @@ +<script> +function go() { + window.find("1", true, false) + a.setAttribute("contenteditable", "true") + document.execCommand("forwardDelete", false) + document.execCommand("enableObjectResizing", false) +} +</script> +<dl id="a"> +<table> +<th> +GjdR1W3 +<svg> +<animateMotion onbegin="go()" /> +</tr> +<details ontoggle="go()" open> diff --git a/editor/libeditor/crashtests/1618906.html b/editor/libeditor/crashtests/1618906.html new file mode 100644 index 0000000000..cdb278f018 --- /dev/null +++ b/editor/libeditor/crashtests/1618906.html @@ -0,0 +1,17 @@ +<html> +<head> + <script> + window.addEventListener('load', () => { + const range = new Range() + const fragment = range.cloneContents() + range.selectNodeContents(document) + document.designMode = 'on' + document.replaceChild(fragment, document.documentElement) + const selection = window.getSelection() + selection.addRange(range) + document.execCommand('indent', false, null) + }) + </script> +</head> +</html> +<!-- COMMENT --> diff --git a/editor/libeditor/crashtests/1623913.html b/editor/libeditor/crashtests/1623913.html new file mode 100644 index 0000000000..291bd65197 --- /dev/null +++ b/editor/libeditor/crashtests/1623913.html @@ -0,0 +1,30 @@ +<html> +<head> + <script> + async function start () { + const element_0 = document.createElementNS('', 's') + const svg = document.getElementById('id_8') + const math = document.getElementById('id_20') + const selection = window.getSelection() + const range = new Range() + range.setStartAfter(math) + range.insertNode(svg) + range.selectNodeContents(element_0) + document.documentElement.contentEditable = true + range.setStart(svg, (2760506212 % svg.childNodes)) + selection.addRange(range) + document.execCommand('insertOrderedList', false, null) + document.execCommand('insertParagraph', false, null) + } + + document.addEventListener('DOMContentLoaded', start) + </script> +</head> +<body> +<svg id='id_8'> + <metadata xml:space='preserve'> +</svg> +<math id='id_20'> +</math> +</body> +</html> diff --git a/editor/libeditor/crashtests/1624005.html b/editor/libeditor/crashtests/1624005.html new file mode 100644 index 0000000000..9d277db6ed --- /dev/null +++ b/editor/libeditor/crashtests/1624005.html @@ -0,0 +1,14 @@ +<html> +<head> + <script> + window.addEventListener('load', () => { + const element = document.createElementNS('', 't') + document.designMode = 'on' + const range = new Range() + range.selectNodeContents(element) + range.surroundContents(document.documentElement) + document.execCommand('insertHorizontalRule', false, null) + }) + </script> +</head> +</html> diff --git a/editor/libeditor/crashtests/1624007.html b/editor/libeditor/crashtests/1624007.html new file mode 100644 index 0000000000..06e35e1d50 --- /dev/null +++ b/editor/libeditor/crashtests/1624007.html @@ -0,0 +1,19 @@ +<html> +<head> + <script> + window.addEventListener('load', () => { + const element = document.createElement('t') + document.documentElement.appendChild(element) + document.documentElement.contentEditable = true + const selection = self.getSelection() + const range_1 = new Range() + range_1.setStart(element, (1715865858 % element.childNodes)) + document.execCommand('enableObjectResizing', false, true) + const range_2 = new Range() + selection.addRange(range_2) + selection.addRange(range_1) + document.execCommand('bold', false, null) + }) + </script> +</head> +</html> diff --git a/editor/libeditor/crashtests/1624011.html b/editor/libeditor/crashtests/1624011.html new file mode 100644 index 0000000000..98267f848d --- /dev/null +++ b/editor/libeditor/crashtests/1624011.html @@ -0,0 +1,12 @@ +<html> +<head> + <script> + window.addEventListener('load', () => { + document.designMode = 'on' + const selection = document.getSelection() + selection.empty() + document.queryCommandIndeterm('justifyFull') + }) + </script> +</head> +</html> diff --git a/editor/libeditor/crashtests/1644903.html b/editor/libeditor/crashtests/1644903.html new file mode 100644 index 0000000000..90006c74da --- /dev/null +++ b/editor/libeditor/crashtests/1644903.html @@ -0,0 +1,14 @@ +<script> +window.onload = () => { + document.execCommand("undo", false) +} +function go() { + var a = document.getElementById("a") + document.execCommand("delete", false) + b.contentDocument.adoptNode(a) +} +</script> +<p contenteditable="true"> +<link id="a" item=""> +<details open="" ontoggle="go()"> +<iframe id="b"></iframe> diff --git a/editor/libeditor/crashtests/1645983-1.html b/editor/libeditor/crashtests/1645983-1.html new file mode 100644 index 0000000000..d2dbd44b07 --- /dev/null +++ b/editor/libeditor/crashtests/1645983-1.html @@ -0,0 +1,8 @@ +<div contenteditable> a</div> +<script> +let editor = document.querySelector("div[contenteditable]"); +editor.insertBefore(document.createTextNode(""), editor.firstChild); +let selection = getSelection(); +selection.collapse(editor.firstChild.nextSibling, 2); +document.execCommand("delete", false); +</script>
\ No newline at end of file diff --git a/editor/libeditor/crashtests/1645983-2.html b/editor/libeditor/crashtests/1645983-2.html new file mode 100644 index 0000000000..aee3833bf9 --- /dev/null +++ b/editor/libeditor/crashtests/1645983-2.html @@ -0,0 +1,7 @@ +<!doctype html> +<div contenteditable>abc<span></span><span></span></div> +<script> +let editor = document.querySelector("div[contenteditable]"); +getSelection().collapse(editor, 3); +document.execCommand("inserttext", false, " "); +</script> diff --git a/editor/libeditor/crashtests/1648564.html b/editor/libeditor/crashtests/1648564.html new file mode 100644 index 0000000000..610cd54663 --- /dev/null +++ b/editor/libeditor/crashtests/1648564.html @@ -0,0 +1,19 @@ +<script> + window.addEventListener('load', () => { + const map = document.getElementById('id_2') + const anchor = document.getElementById('id_9') + map.replaceChild(anchor, map.childNodes[(2828994049 % map.childNodes.length)]) + anchor.innerHTML = '<o>' + const selection = self.getSelection() + selection.setBaseAndExtent(document, (2019424593 % document.childNodes.length), document.documentElement, (3503355750 % document.documentElement.childNodes.length)) + document.designMode = 'on' + document.execCommand('forwardDelete', false, null) + document.execCommand('forwardDelete', false, null) +}) +</script> +<sub contenteditable='true'> +<map id='id_2'> +<address></address> +<a id='id_9'> +</a> +<!-- COMMENT -->
\ No newline at end of file diff --git a/editor/libeditor/crashtests/1659717.html b/editor/libeditor/crashtests/1659717.html new file mode 100644 index 0000000000..a3e9c59699 --- /dev/null +++ b/editor/libeditor/crashtests/1659717.html @@ -0,0 +1,14 @@ +<html><script type="text/javascript" id="__gaOptOutExtension">window["_gaUserPrefs"] = { ioo : function() { return true; } }</script><head>
+<meta http-equiv="content-type" content="text/html; charset=windows-1252">
+ <script>
+ document.addEventListener('DOMContentLoaded', async () => {
+ const selection = document.getSelection()
+ document.designMode = 'on'
+ selection.collapse(document, 0)
+ document.execCommand('forwardDelete', false, null)
+ })
+ </script>
+</head>
+<body>
+<aside style="position:fixed;top:0px;right:0px;font-family:"Lucida Console",monospace;background-color:#f2e6d9;padding:3px;z-index:10000;text-align:center;max-width:120px;opacity:0;transition:opacity linear;"></aside></body></html>
+<!-- COMMENT -->
\ No newline at end of file diff --git a/editor/libeditor/crashtests/1663725.html b/editor/libeditor/crashtests/1663725.html new file mode 100644 index 0000000000..28bed36d5c --- /dev/null +++ b/editor/libeditor/crashtests/1663725.html @@ -0,0 +1,13 @@ +<script> +window.onload = () => { + document.execCommand("insertHorizontalRule", false) + window.getSelection().collapse(b) + document.execCommand("forwardDelete", false) +} +function go() { + document.getSelection().setPosition(a) +} +</script> +<pre id="a"> +<time contenteditable>a|</t> +<input id="b" onfocus="go()" autofocus onblur="go()"> diff --git a/editor/libeditor/crashtests/1666556.html b/editor/libeditor/crashtests/1666556.html new file mode 100644 index 0000000000..121a598ad9 --- /dev/null +++ b/editor/libeditor/crashtests/1666556.html @@ -0,0 +1,19 @@ +<script> +function func_a() { + a.appendChild(b) + document.execCommand("indent", false) +} +function func_b() { + document.execCommand("delete", false) + a.contentEditable = "true" + c.select() +} +</script> +<video focus="false"> +<source onerror="func_a()"> +</video> +<details id="a" open="tru"> +<p id="b"> +<input id="c" contenteditable="pla"> +<style onload="func_b()"> +<!-- x --> diff --git a/editor/libeditor/crashtests/336081-1.xhtml b/editor/libeditor/crashtests/336081-1.xhtml new file mode 100644 index 0000000000..5a499d9f51 --- /dev/null +++ b/editor/libeditor/crashtests/336081-1.xhtml @@ -0,0 +1,52 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait"> +<head> +<script> +<![CDATA[ + +function foop(targetWindow) +{ + var targetDocument = targetWindow.document; + + var r1 = targetDocument.createRange(); + r1.setStart(targetDocument.getElementById("out1"), 0); + r1.setEnd (targetDocument.getElementById("out2"), 0); + targetWindow.getSelection().addRange(r1); + + var r2 = targetDocument.createRange(); + r2.setStart(targetDocument.getElementById("in1"), 0); + r2.setEnd (targetDocument.getElementById("in2"), 0); + targetWindow.getSelection().addRange(r2); + + targetDocument.execCommand('removeformat', false, null); + targetDocument.execCommand('outdent', false, null); +} + +function init() +{ + setTimeout(function() + { + var fd = window.frames[0].document; + fd.body.appendChild(fd.importNode(document.getElementById('rootish'), true)); + fd.designMode = 'on'; + foop(window.frames[0]); + document.documentElement.removeAttribute("class"); + }, 100); +} + +]]> +</script> +</head> + +<body onload="init()"> + +<iframe srcdoc="<html></html>" style="width: 95%; height: 500px;"/> + +<div id="rootish"> +<div id="out1"/> +<div id="in1"/> +<div id="in2"/> +<div id="out2"/> +</div> + +</body> +</html> diff --git a/editor/libeditor/crashtests/336104.html b/editor/libeditor/crashtests/336104.html new file mode 100644 index 0000000000..32f11b745d --- /dev/null +++ b/editor/libeditor/crashtests/336104.html @@ -0,0 +1,37 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script> +function init() +{ + var targetWindow = window.frames[0]; + var targetDocument = targetWindow.document; + var rootish = document.getElementById('rootish'); + + targetDocument.body.appendChild(targetDocument.adoptNode(rootish)); + targetDocument.designMode = 'on'; + + targetWindow.getSelection().removeAllRanges(); + + var r = targetDocument.createRange(); + r.setStart(targetDocument.getElementById("start"), 0); + r.setEnd (targetDocument.getElementById("endparent").firstChild, 0); + targetWindow.getSelection().addRange(r); + + targetDocument.execCommand('outdent', false, null); +} +</script> + +</head> + +<body onload="setTimeout(init, 300);"> + +<iframe src="data:text/html," style="width: 95%; height: 500px;"></iframe> + +<div id="rootish"> + <div id="start"></div> + <p>Huh</p> + <svg xmlns="http://www.w3.org/2000/svg" id="endparent"> </svg> +</div> + +</body> +</html> diff --git a/editor/libeditor/crashtests/382527-1.html b/editor/libeditor/crashtests/382527-1.html new file mode 100644 index 0000000000..188fbdc122 --- /dev/null +++ b/editor/libeditor/crashtests/382527-1.html @@ -0,0 +1,58 @@ +<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+
+
+function init1()
+{
+ targetIframe = document.createElementNS('http://www.w3.org/1999/xhtml', 'iframe');
+ targetIframe.srcdoc = "<html></html>";
+ targetIframe.setAttribute("style", "width: 300px; height: 200px; border: 1px dotted green;");
+ targetIframe.addEventListener("load", init2);
+ document.body.appendChild(targetIframe);
+}
+
+
+function init2()
+{
+ targetWindow = targetIframe.contentWindow;
+ targetDocument = targetWindow.document;
+
+ var div = document.getElementById("div");
+ textNode = div.firstChild;
+
+ targetDocument.body.appendChild(targetDocument.adoptNode(div, true));
+
+ targetDocument.designMode = 'on';
+ setTimeout(init3, 0);
+}
+
+
+function init3()
+{
+ var rng = targetDocument.createRange();
+ rng.setStart(textNode, 1);
+ rng.setEnd(textNode, 1);
+ targetWindow.getSelection().addRange(rng);
+
+ try {
+ targetDocument.execCommand("inserthtml", false, "<p>");
+ } catch(e) {}
+
+ document.documentElement.removeAttribute("class");
+}
+
+
+</script>
+
+</head>
+
+<body onload="init1();">
+
+<div id="div"> </div>
+
+<script>
+</script>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/382778-1.html b/editor/libeditor/crashtests/382778-1.html new file mode 100644 index 0000000000..156a58f220 --- /dev/null +++ b/editor/libeditor/crashtests/382778-1.html @@ -0,0 +1,53 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<head> +<script> + +function init1() +{ + // Create an html:iframe in HTML mode (so designMode can be used 320092) + targetIframe = document.createElementNS('http://www.w3.org/1999/xhtml', 'iframe'); + targetIframe.srcdoc = "<html></html>"; + targetIframe.setAttribute("style", "width: 700px; height: 500px; border: 1px dotted green;"); + targetIframe.addEventListener("load", init2); + document.body.appendChild(targetIframe); +} + + +function init2() +{ + targetWindow = targetIframe.contentWindow; + targetDocument = targetWindow.document; + + p = document.getElementById("p"); + pText = p.firstChild; + + targetDocument.body.appendChild(targetDocument.adoptNode(p, true)); + + targetDocument.designMode = 'on'; + + setTimeout(boom, 0); +} + + +function boom() +{ + var rng = targetDocument.createRange(); + rng.setStart(pText, 3); + rng.setEnd(pText, 3); + + targetWindow.getSelection().addRange(rng); + + targetDocument.execCommand("insertorderedlist", false, null); + + document.documentElement.removeAttribute("class") +} + +</script> +</head> + +<body onload="init1();"> +<p id="p">word word</p> +</body> + +</html> diff --git a/editor/libeditor/crashtests/402172-1.html b/editor/libeditor/crashtests/402172-1.html new file mode 100644 index 0000000000..4022523fa0 --- /dev/null +++ b/editor/libeditor/crashtests/402172-1.html @@ -0,0 +1,23 @@ +<html> +<head> +<script> + +function boom() +{ + document.getElementById("div").contentEditable = "true"; + document.getElementById("div").focus(); + document.getElementById("div").contentEditable = "false"; + + document.getElementById("table").contentEditable = "true"; +} + +</script> +</head> + +<body onload="boom();"> + +<table id="table"><td></td></table><div id="div"></div> + +</body> + +</html> diff --git a/editor/libeditor/crashtests/403965-1.xhtml b/editor/libeditor/crashtests/403965-1.xhtml new file mode 100644 index 0000000000..02993914d9 --- /dev/null +++ b/editor/libeditor/crashtests/403965-1.xhtml @@ -0,0 +1,7 @@ +<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"> +<tbody contenteditable="true"/> +<frameset/> +<xul:box onbeforecopy="event.explicitOriginalTarget.parentNode.parentNode.removeChild(event.explicitOriginalTarget.parentNode)"> +<xul:box/> +</xul:box> +</html>
\ No newline at end of file diff --git a/editor/libeditor/crashtests/407074-1.html b/editor/libeditor/crashtests/407074-1.html new file mode 100644 index 0000000000..22f172856a --- /dev/null +++ b/editor/libeditor/crashtests/407074-1.html @@ -0,0 +1,7 @@ +<html> +<head> +</head> + +<body onload="try { document.execCommand('inserthtml', false, '0'); } catch(e) { }"><span id="textarea" contenteditable="true">is</span></body> + +</html> diff --git a/editor/libeditor/crashtests/407079-1.html b/editor/libeditor/crashtests/407079-1.html new file mode 100644 index 0000000000..8b0e36cd65 --- /dev/null +++ b/editor/libeditor/crashtests/407079-1.html @@ -0,0 +1,15 @@ +<html> +<head> +<script type="text/javascript"> + +function boom() +{ + document.execCommand("selectAll", false, null); + document.execCommand("inserthtml", false, "<p>"); +} + +</script> +</head> + +<body onload="boom();"><textarea contenteditable="true"></textarea></body> +</html> diff --git a/editor/libeditor/crashtests/407256-1.html b/editor/libeditor/crashtests/407256-1.html new file mode 100644 index 0000000000..36c146f4c5 --- /dev/null +++ b/editor/libeditor/crashtests/407256-1.html @@ -0,0 +1,23 @@ +<html> +<head> +<script type="text/javascript"> + +function boom() +{ + document.addEventListener("DOMNodeInserted", x); + + function x() + { + document.removeEventListener("DOMNodeInserted", x); + document.execCommand("insertParagraph", false, ""); + } + + document.execCommand("insertorderedlist", false, ""); +} + +</script> +</head> + +<body contenteditable="true" onload="boom()"></body> + +</html> diff --git a/editor/libeditor/crashtests/407277-1.html b/editor/libeditor/crashtests/407277-1.html new file mode 100644 index 0000000000..41c6bf2801 --- /dev/null +++ b/editor/libeditor/crashtests/407277-1.html @@ -0,0 +1,7 @@ +<html> +<head> +</head> +<body style="margin: initial;" + contenteditable="true" + onload="document.execCommand('outdent', false, null);"></body> +</html> diff --git a/editor/libeditor/crashtests/414178-1.html b/editor/libeditor/crashtests/414178-1.html new file mode 100644 index 0000000000..19cc205b91 --- /dev/null +++ b/editor/libeditor/crashtests/414178-1.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html> +<head> +<script type="text/javascript"> + +function boom() +{ + var table = document.createElement("table"); + document.body.appendChild(table); + table.contentEditable = "true"; + table.focus(); + try { + // This will throw, since it's attempting to inject a list inside a table + document.execCommand("insertunorderedlist", false, null); + } catch (e) {} +} + +</script> +</head> + +<body onload="boom();"></body> +</html> diff --git a/editor/libeditor/crashtests/418923-1.html b/editor/libeditor/crashtests/418923-1.html new file mode 100644 index 0000000000..786ea25d9a --- /dev/null +++ b/editor/libeditor/crashtests/418923-1.html @@ -0,0 +1,19 @@ +<html><head><script type="text/javascript"> + +function boom() +{ + var dE = document.documentElement; + var head = document.getElementsByTagName("head")[0]; + dE.removeChild(document.body); + dE.contentEditable = "true"; + dE.focus(); + dE.contentEditable = "false"; + head.focus(); + head.contentEditable = "true"; + try { + document.execCommand("selectAll", false, ""); + } catch(e) { + } +} + +</script></head><body onload="boom();"></body></html>
\ No newline at end of file diff --git a/editor/libeditor/crashtests/420439.html b/editor/libeditor/crashtests/420439.html new file mode 100644 index 0000000000..d151ac65f1 --- /dev/null +++ b/editor/libeditor/crashtests/420439.html @@ -0,0 +1,30 @@ +<html> +<head> +<script type="text/javascript"> + +function boom() +{ + function x() + { + document.removeEventListener("DOMAttrModified", x); + document.execCommand("backcolor", false, "green"); + } + + document.getElementById("td").focus(); + + document.addEventListener("DOMAttrModified", x); + try { + document.execCommand("subscript", false, null); + } catch(e) { + } + document.removeEventListener("DOMAttrModified", x); +} + +</script> +</head> + +<body contenteditable="true" onload="setTimeout(boom, 30);"> +<table><tbody contenteditable="false"><tr><td contenteditable="true" id="td"></td></tr></tbody></table> +</body> + +</html> diff --git a/editor/libeditor/crashtests/428489-1.html b/editor/libeditor/crashtests/428489-1.html new file mode 100644 index 0000000000..8eec1268b9 --- /dev/null +++ b/editor/libeditor/crashtests/428489-1.html @@ -0,0 +1,8 @@ +<html>
+<head>
+<title>Crash [@ nsHTMLEditor::GetPositionAndDimensions] when window gets removed during click on contenteditable absolute positioned element</title>
+</head>
+<body>
+<iframe id="content" src="data:text/html;charset=utf-8,%3Chtml%3E%3Chead%3E%0A%3Cscript%3E%0Awindow.addEventListener%28%27DOMAttrModified%27%2C%20function%28e%29%20%7Bdump%28%27DOMAttrModified\n%27%29%3Bwindow.frameElement.parentNode.removeChild%28window.frameElement%29%3B%7D%2C%20true%29%3B%0A%3C/script%3E%0A%3C/head%3E%0A%3Cbody%3E%0A%3Cdiv%20style%3D%22position%3A%20absolute%3B%22%20contenteditable%3D%22true%22%3EClicking%20on%20this%20should%20not%20crash%20Mozilla%0A%3C/body%3E%0A%3C/html%3E" style="width:1000px;height: 300px;"></iframe>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/429586-1.html b/editor/libeditor/crashtests/429586-1.html new file mode 100644 index 0000000000..a32df3b721 --- /dev/null +++ b/editor/libeditor/crashtests/429586-1.html @@ -0,0 +1,8 @@ +<html>
+<head>
+<title>Bug 429586 - Crash [@ nsEditor::EndUpdateViewBatch] with pasting and domattrmodified removing iframe</title>
+</head>
+<body>
+<iframe id="content" src="data:text/html;charset=utf-8,%3Chtml%3E%0A%3Chead%3E%0A%3C/head%3E%0A%3Cbody%20contenteditable%3D%22true%22%3E%0A%0A%3Cscript%3E%0Afunction%20dokey%28%29%7B%0Adocument.body.focus%28%29%3B%0Adocument.execCommand%28%27insertParagraph%27%2C%20false%2C%20%27%27%29%3B%0A%7D%0AsetTimeout%28dokey%2C200%29%3B%0A%0Adocument.addEventListener%28%27DOMAttrModified%27%2C%20function%28%29%20%7Bwindow.frameElement.parentNode.removeChild%28window.frameElement%29%7D%2C%20true%29%3B%0A%3C/script%3E%0A%3C/body%3E%0A%3C/html%3E"></iframe>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/430624-1.html b/editor/libeditor/crashtests/430624-1.html new file mode 100644 index 0000000000..18b566dca5 --- /dev/null +++ b/editor/libeditor/crashtests/430624-1.html @@ -0,0 +1,14 @@ +<html> +<head> +<script> +function crash() { + window.frames[0].onload = null; + window.frames[0].location = 'data:text/html;charset=utf-8,2nd%20page'; +} +</script> +</head> +<body onload="crash()"> + <!-- iframe contents: <html><body onload="document.body.setAttribute('spellcheck', true);"></body></html> --> + <iframe src="data:text/html;charset=utf-8;base64,PGh0bWw%2BPGJvZHkgb25sb2FkPSJkb2N1bWVudC5ib2R5LnNldEF0dHJpYnV0ZSgnc3BlbGxjaGVjaycsIHRydWUpOyI%2BPC9ib2R5PjwvaHRtbD4%3D"></iframe> +</body> +</html> diff --git a/editor/libeditor/crashtests/431086-1.xhtml b/editor/libeditor/crashtests/431086-1.xhtml new file mode 100644 index 0000000000..c6c5d8d992 --- /dev/null +++ b/editor/libeditor/crashtests/431086-1.xhtml @@ -0,0 +1,22 @@ +<div xmlns="http://www.w3.org/1999/xhtml"> + +<script type="text/javascript"> + +function boom() +{ + var r = document.documentElement; + r.style.position = "absolute"; + r.contentEditable = "true"; + r.focus(); + r.contentEditable = "false"; + r.focus(); + r.contentEditable = "true"; + document.execCommand("subscript", false, null); + r.contentEditable = "false"; +} + +window.addEventListener("load", boom, false); + +</script> + +</div> diff --git a/editor/libeditor/crashtests/448329-1.html b/editor/libeditor/crashtests/448329-1.html new file mode 100644 index 0000000000..99d0f63b34 --- /dev/null +++ b/editor/libeditor/crashtests/448329-1.html @@ -0,0 +1,72 @@ +<!DOCTYPE HTML> +<html><head> + <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> + <title>Testcase for bug 448329</title> +</head> +<body> + +<iframe id="frame448329"></iframe> + +<script> + +function test448329(id,cmd) { + + var elm = document.getElementById(id); + var doc = elm.contentDocument; + doc.designMode = "On"; + + // Work around getSelection depending on a presshell but not flushing to get + // one. + doc.body.offsetWidth; + var s = doc.defaultView.getSelection(); + + // Test document node + if (s.rangeCount > 0) + s.removeAllRanges(); + var range = doc.createRange(); + range.setStart(doc, 0); + range.setEnd(doc, 0); + s.addRange(range); + doc.queryCommandIndeterm(cmd); + + // Test HTML node + if (s.rangeCount > 0) + s.removeAllRanges(); + range = doc.createRange(); + range.setStart(doc.documentElement, 0); + range.setEnd(doc.documentElement, 0); + s.addRange(range); + doc.queryCommandIndeterm(cmd); + + // Test BODY node + if (s.rangeCount > 0) + s.removeAllRanges(); + range = doc.createRange(); + var body = doc.documentElement.childNodes[1]; + range.setStart(body, 0); + range.setEnd(body, 0); + s.addRange(range); + doc.queryCommandIndeterm(cmd); + + var text = doc.createTextNode("Hello Kitty"); + body.insertBefore(text, null) + + // Test TEXT node + if (s.rangeCount > 0) + s.removeAllRanges(); + range = doc.createRange(); + range.setStart(text, 0); + range.setEnd(text, 1); + s.addRange(range); + doc.queryCommandIndeterm(cmd); + +} + +test448329("frame448329", "backcolor") +test448329("frame448329", "hilitecolor") + +</script> + + +</body> +</html> diff --git a/editor/libeditor/crashtests/448329-2.html b/editor/libeditor/crashtests/448329-2.html new file mode 100644 index 0000000000..fd4707b54c --- /dev/null +++ b/editor/libeditor/crashtests/448329-2.html @@ -0,0 +1,21 @@ +<html> +<head> + <title>Testcase for bug 448329</title> +<script> +function go() { + test("myFrame", "backcolor"); +} +function test(id,cmd) { + var doc = document.getElementById(id).contentDocument; + doc.designMode = "On"; + + var s = doc.defaultView.getSelection(); + s.removeAllRanges(); + s.addRange(doc.createRange()); + + doc.queryCommandIndeterm(cmd); +} +</script> +</head> +<body onload="go()"><iframe id="myFrame"></iframe></body> +</html> diff --git a/editor/libeditor/crashtests/448329-3.html b/editor/libeditor/crashtests/448329-3.html new file mode 100644 index 0000000000..0a48c1818c --- /dev/null +++ b/editor/libeditor/crashtests/448329-3.html @@ -0,0 +1,112 @@ +<!DOCTYPE HTML> +<html><head> + <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> + <title>Testcase #3 for bug 448329</title> +</head> +<body> + +<iframe id="frame448329"></iframe> + +<script> + +function test448329(id,cmd,val) { + + var elm = document.getElementById(id); + var doc = elm.contentDocument; + doc.designMode = "On"; + + // Work around getSelection depending on a presshell but not flushing to get + // one. + doc.body.offsetWidth; + var s = doc.defaultView.getSelection(); + + // Test document node + if (s.rangeCount > 0) + s.removeAllRanges(); + var range = doc.createRange(); + range.setStart(doc, 0); + range.setEnd(doc, 0); + s.addRange(range); + doc.execCommand(cmd,false,val); + + // Test HTML node + if (s.rangeCount > 0) + s.removeAllRanges(); + range = doc.createRange(); + range.setStart(doc.documentElement, 0); + range.setEnd(doc.documentElement, 0); + s.addRange(range); + doc.execCommand(cmd,false,val); + + // Test BODY node + if (s.rangeCount > 0) + s.removeAllRanges(); + range = doc.createRange(); + var body = doc.documentElement.childNodes[1]; + range.setStart(body, 0); + range.setEnd(body, 0); + s.addRange(range); + doc.execCommand(cmd,false,val); + + var text = doc.createTextNode("Hello Kitty"); + body.insertBefore(text, null) + + // Test TEXT node + if (s.rangeCount > 0) + s.removeAllRanges(); + range = doc.createRange(); + range.setStart(text, 0); + range.setEnd(text, 1); + s.addRange(range); + doc.execCommand(cmd,false,val); + + // Test BODY[0,0] + TEXT node + if (s.rangeCount > 0) + s.removeAllRanges(); + range = doc.createRange(); + range.setStart(body, 0); + range.setEnd(body, 0); + s.addRange(range); + range = doc.createRange(); + range.setStart(text, 0); + range.setEnd(text, 1); + s.addRange(range); + doc.execCommand(cmd,false,val); + + // Test BODY[0,1] + TEXT node + if (s.rangeCount > 0) + s.removeAllRanges(); + range = doc.createRange(); + range.setStart(body, 0); + range.setEnd(body, 1); + s.addRange(range); + range = doc.createRange(); + range.setStart(text, 0); + range.setEnd(text, 1); + s.addRange(range); + doc.execCommand(cmd,false,val); + + // Test BODY[0,1] + TEXT node without a parent + if (s.rangeCount > 0) + s.removeAllRanges(); + range = doc.createRange(); + range.setStart(body, 0); + range.setEnd(body, 1); + s.addRange(range); + range = doc.createRange(); + text = doc.createTextNode("Hello Kitty"); // not in doc + range.setStart(text, 0); + range.setEnd(text, 1); + s.addRange(range); + doc.execCommand(cmd,false,val); + +} + +test448329("frame448329", "backcolor", "green") +test448329("frame448329", "hilitecolor", "green") + +</script> + + +</body> +</html> diff --git a/editor/libeditor/crashtests/456727-1.html b/editor/libeditor/crashtests/456727-1.html new file mode 100644 index 0000000000..d14422c931 --- /dev/null +++ b/editor/libeditor/crashtests/456727-1.html @@ -0,0 +1,8 @@ +<html> +<BODY onload=" +document.designMode='on'; +document.replaceChild(document.createElement('HTML'), document.firstChild); +document.queryCommandValue('backcolor'); +"> +</body> +</html>
\ No newline at end of file diff --git a/editor/libeditor/crashtests/456727-2.html b/editor/libeditor/crashtests/456727-2.html new file mode 100644 index 0000000000..1c8fe5db9b --- /dev/null +++ b/editor/libeditor/crashtests/456727-2.html @@ -0,0 +1,8 @@ +<html> +<BODY onload=" +document.designMode='on'; +document.removeChild(document.firstChild); +document.queryCommandState('BackColor'); +"> +</body> +</html> diff --git a/editor/libeditor/crashtests/459613-iframe.html b/editor/libeditor/crashtests/459613-iframe.html new file mode 100644 index 0000000000..9f6e558d0d --- /dev/null +++ b/editor/libeditor/crashtests/459613-iframe.html @@ -0,0 +1 @@ +<html><body><textarea>notaword</textarea></body></html> diff --git a/editor/libeditor/crashtests/459613.html b/editor/libeditor/crashtests/459613.html new file mode 100644 index 0000000000..7a335f22ed --- /dev/null +++ b/editor/libeditor/crashtests/459613.html @@ -0,0 +1,17 @@ +<html class="reftest-wait"> +<head> +<script type="text/javascript"> + +function finish() { + document.documentElement.removeAttribute("class"); +} + +</script> +</head> + +<body> + +<iframe src="459613-iframe.html" onload="finish();"></iframe> + +</body> +</html> diff --git a/editor/libeditor/crashtests/467647-1.html b/editor/libeditor/crashtests/467647-1.html new file mode 100644 index 0000000000..7bb4271d74 --- /dev/null +++ b/editor/libeditor/crashtests/467647-1.html @@ -0,0 +1,19 @@ +<!DOCTYPE html> +<html> +<head> +<script type="text/javascript"> + +function boom() +{ + document.getElementById("s").focus(); + try { + document.execCommand("insertorderedlist", false, null); + } catch(e) { } +} + +</script> +</head> + +<body onload="boom();"><span id="s" contenteditable="true">One<div></div></span><marquee></marquee></body> + +</html> diff --git a/editor/libeditor/crashtests/475132-1.xhtml b/editor/libeditor/crashtests/475132-1.xhtml new file mode 100644 index 0000000000..8b4dd688ce --- /dev/null +++ b/editor/libeditor/crashtests/475132-1.xhtml @@ -0,0 +1,20 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script type="text/javascript"> + +function boom() +{ + document.getElementsByTagName("td")[0].contentEditable = "true"; + document.getElementsByTagName("td")[0].focus(); + document.documentElement.contentEditable = "true"; + document.documentElement.focus(); + document.execCommand("indent", false, null); + document.execCommand("insertParagraph", false, null); +} + +</script> +</head> + +<body onload="boom();" contenteditable="false"><td></td></body> + +</html> diff --git a/editor/libeditor/crashtests/499844-1.html b/editor/libeditor/crashtests/499844-1.html new file mode 100644 index 0000000000..4fa509c4a6 --- /dev/null +++ b/editor/libeditor/crashtests/499844-1.html @@ -0,0 +1,15 @@ +<html> +<head> +<script type="text/javascript"> + +function boom() +{ + document.body.contentEditable = "true"; + document.execCommand("outdent", false, null); +} + +</script> +</head> + +<body style="word-spacing: 3px;" onload="boom();"> ́</body> +</html> diff --git a/editor/libeditor/crashtests/503709-1.xhtml b/editor/libeditor/crashtests/503709-1.xhtml new file mode 100644 index 0000000000..867bebf1a9 --- /dev/null +++ b/editor/libeditor/crashtests/503709-1.xhtml @@ -0,0 +1,11 @@ +<html contenteditable="true" xmlns="http://www.w3.org/1999/xhtml"><head><script> + +function boom() +{ + document.execCommand("selectAll", false, ""); + try { document.execCommand("justifyfull", false, null); } catch(e) { } + try { document.execCommand("inserthorizontalrule", false, "false"); } catch(e) { } + document.execCommand("delete", false, null); +} + +</script></head>x y z<body onload="boom();"><div/></body></html> diff --git a/editor/libeditor/crashtests/513375-1.xhtml b/editor/libeditor/crashtests/513375-1.xhtml new file mode 100644 index 0000000000..25e5e1c34c --- /dev/null +++ b/editor/libeditor/crashtests/513375-1.xhtml @@ -0,0 +1,19 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head contenteditable="true"> +<script type="text/javascript"> +<![CDATA[ + +function boom() +{ + var r = document.createRange(); + r.selectNode(document.body); + r.deleteContents(); + try { document.execCommand("selectAll", false, null); } catch(e) { } +} + +]]> +</script> +</head> + +<body onload="boom();" contenteditable="true"></body> +</html> diff --git a/editor/libeditor/crashtests/535632-1.xhtml b/editor/libeditor/crashtests/535632-1.xhtml new file mode 100644 index 0000000000..92470b8258 --- /dev/null +++ b/editor/libeditor/crashtests/535632-1.xhtml @@ -0,0 +1 @@ +<body xmlns="http://www.w3.org/1999/xhtml" style="margin: 200px;" contenteditable="true" onload="document.execCommand('outdent', false, null);" />
\ No newline at end of file diff --git a/editor/libeditor/crashtests/574558-1.xhtml b/editor/libeditor/crashtests/574558-1.xhtml new file mode 100644 index 0000000000..6aac47072f --- /dev/null +++ b/editor/libeditor/crashtests/574558-1.xhtml @@ -0,0 +1,15 @@ +<html xmlns="http://www.w3.org/1999/xhtml"><head><script> +<![CDATA[ + +function boom() +{ + document.execCommand("selectAll", false, null); + document.execCommand("selectAll", false, null); + document.execCommand("inserthtml", false, "<span><div>"); + var textarea = document.getElementById("textarea"); + var span = document.createElementNS("http://www.w3.org/1999/xhtml", "span"); + textarea.appendChild(span); +} + +]]> +</script></head><div contenteditable="true"></div><body onload="boom();"><textarea id="textarea">f</textarea></body></html> diff --git a/editor/libeditor/crashtests/580151-1.xhtml b/editor/libeditor/crashtests/580151-1.xhtml new file mode 100644 index 0000000000..3799411117 --- /dev/null +++ b/editor/libeditor/crashtests/580151-1.xhtml @@ -0,0 +1,26 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +var t; + +function boom() +{ + var b = document.createElementNS("http://www.w3.org/1999/xhtml", "body"); + t = document.createElementNS("http://www.w3.org/1999/xhtml", "textarea"); + b.appendChild(t); + document.removeChild(document.documentElement) + document.appendChild(b) + document.removeChild(document.documentElement) + var ns = document.createElementNS("http://www.w3.org/1999/xhtml", "script"); + var nt = document.createTextNode("t.appendChild(document.createTextNode(' '));"); + ns.appendChild(nt); + b.appendChild(ns); + document.appendChild(b); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/editor/libeditor/crashtests/582138-1.xhtml b/editor/libeditor/crashtests/582138-1.xhtml new file mode 100644 index 0000000000..afcec2eba1 --- /dev/null +++ b/editor/libeditor/crashtests/582138-1.xhtml @@ -0,0 +1,10 @@ +<html xmlns="http://www.w3.org/1999/xhtml"><mtr xmlns="http://www.w3.org/1998/Math/MathML"><td id="cell" xmlns="http://www.w3.org/1999/xhtml"></td></mtr><script> +function boom() +{ + document.getElementById("cell").contentEditable = true; + document.getElementById("cell").focus(); + document.execCommand("inserthtml", false, "x"); +} + +window.addEventListener("load", boom, false); +</script></html> diff --git a/editor/libeditor/crashtests/612565-1.html b/editor/libeditor/crashtests/612565-1.html new file mode 100644 index 0000000000..8df4283f8d --- /dev/null +++ b/editor/libeditor/crashtests/612565-1.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html> + <body> + <iframe></iframe> + </body> + <script> + onload = function() { + var i = document.querySelector("iframe"); + var doc = i.contentDocument; + doc.body.appendChild(doc.createTextNode("foo")); + doc.designMode = "on"; + while (doc.body.firstChild) { + doc.body.firstChild.remove(); + } + }; + </script> +</html> diff --git a/editor/libeditor/crashtests/615015-1.html b/editor/libeditor/crashtests/615015-1.html new file mode 100644 index 0000000000..a383f9e75b --- /dev/null +++ b/editor/libeditor/crashtests/615015-1.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + document.getElementById("j").focus(); + try { + document.execCommand("insertunorderedlist", false, null); + } catch(e) { } +} + +</script> +</head> +<body onload="boom();"><span><span contenteditable id="j"></span>T</span></body> +</html> diff --git a/editor/libeditor/crashtests/615450-1.html b/editor/libeditor/crashtests/615450-1.html new file mode 100644 index 0000000000..fb36bddc93 --- /dev/null +++ b/editor/libeditor/crashtests/615450-1.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html contenteditable="true"> +<head> +<script> + +function boom() +{ + document.documentElement.appendChild(document.body); + document.documentElement.contentEditable = "false"; + try { document.execCommand("outdent", false, null); } catch(e) { } + document.body.contentEditable = "true"; + try { document.execCommand("inserthtml", false, "x"); } catch(e) { } +} + +</script> +</head> +<body onload="boom();"><div style="margin-left: 40px;"><span contenteditable="true">p q r s</span> T</div></body></html> diff --git a/editor/libeditor/crashtests/633709.xhtml b/editor/libeditor/crashtests/633709.xhtml new file mode 100644 index 0000000000..1393890014 --- /dev/null +++ b/editor/libeditor/crashtests/633709.xhtml @@ -0,0 +1,36 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait"> + +<body><div contenteditable="true"></div><div><input id="i"><div></div></input></div></body> + +<script id="s"> +<![CDATA[ + +function boom() +{ + document.getElementById("i").focus(); + + try { document.execCommand("stylewithcss", false, "true") } catch(e) { } + try { document.execCommand("inserthtml", false, "<x>X</x>"); } catch(e) { } + try { document.execCommand("underline", false, null); } catch(e) { } + try { document.execCommand("justifyfull", false, null); } catch(e) { } + try { document.execCommand("underline", false, null); } catch(e) { } + try { document.execCommand("insertParagraph", false, null); } catch(e) { } + try { document.execCommand("delete", false, null); } catch(e) { } + + try { document.execCommand("stylewithcss", false, "false") } catch(e) { } + try { document.execCommand("inserthtml", false, "<x>X</x>"); } catch(e) { } + try { document.execCommand("underline", false, null); } catch(e) { } + try { document.execCommand("justifyfull", false, null); } catch(e) { } + try { document.execCommand("underline", false, null); } catch(e) { } + try { document.execCommand("insertParagraph", false, null); } catch(e) { } + try { document.execCommand("delete", false, null); } catch(e) { } + + document.documentElement.removeAttribute("class"); +} + +setTimeout(boom, 10); + +]]> +</script> + +</html> diff --git a/editor/libeditor/crashtests/636074-1.html b/editor/libeditor/crashtests/636074-1.html new file mode 100644 index 0000000000..e99c42ea6b --- /dev/null +++ b/editor/libeditor/crashtests/636074-1.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + document.getElementById("i").focus(); + document.documentElement.contentEditable = "true"; + document.execCommand("inserthtml", false, "<table>"); + document.execCommand("indent", false, null); + document.execCommand("delete", false, null); +} + +</script> +</head> +<body onload="boom();"><input id="i"></body> +</html> diff --git a/editor/libeditor/crashtests/639736-1.xhtml b/editor/libeditor/crashtests/639736-1.xhtml new file mode 100644 index 0000000000..4692daee7b --- /dev/null +++ b/editor/libeditor/crashtests/639736-1.xhtml @@ -0,0 +1,14 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script> + +function boom() +{ + try { document.execCommand("removeformat", false, null); } catch(e) { } + document.adoptNode(document.documentElement); +} + +</script> +</head> +<body onload="boom();"><td contenteditable="true" /></body> +</html> diff --git a/editor/libeditor/crashtests/643786-1.html b/editor/libeditor/crashtests/643786-1.html new file mode 100644 index 0000000000..3f0b27a546 --- /dev/null +++ b/editor/libeditor/crashtests/643786-1.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var f = document.getElementById("f"); + var fw = f.contentWindow; + fw.document.designMode = 'on'; + f.style.content = "'m'"; + fw.document.removeChild(fw.document.documentElement) +} + +</script> +</head> +<body onload="boom();"><iframe id="f" src="data:text/html,"></iframe></body> +</html> diff --git a/editor/libeditor/crashtests/650572-1.html b/editor/libeditor/crashtests/650572-1.html new file mode 100644 index 0000000000..a86f6e6186 --- /dev/null +++ b/editor/libeditor/crashtests/650572-1.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + document.documentElement.offsetHeight; + document.getElementById("d").focus(); + document.getElementById("b").style.display = "inline"; + document.getElementById("c").contentEditable = "false"; +} + +</script> +</head> +<body contenteditable="true" id="b" onload="setTimeout(boom, 200);"><div id="c"><input id="d"></div></body> +</html> + diff --git a/editor/libeditor/crashtests/667321-1.html b/editor/libeditor/crashtests/667321-1.html new file mode 100644 index 0000000000..2752695221 --- /dev/null +++ b/editor/libeditor/crashtests/667321-1.html @@ -0,0 +1,15 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + document.body.style.cssFloat = "left"; + document.createElement("div").appendChild(document.querySelector("legend")); +} + +</script> +</head> +<body onload="boom();"><fieldset><legend></legend><textarea></textarea></fieldset></body> +</html> diff --git a/editor/libeditor/crashtests/682650-1.html b/editor/libeditor/crashtests/682650-1.html new file mode 100644 index 0000000000..66ebc2f628 --- /dev/null +++ b/editor/libeditor/crashtests/682650-1.html @@ -0,0 +1,30 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function repeatChar(s, n) +{ + while (s.length < n) + s += s; + return s.substr(0, n); +} + +function boom() +{ + document.documentElement.contentEditable = "true"; + document.execCommand("inserthtml", false, "<button><\/button>"); + document.execCommand("inserthtml", false, repeatChar("i", 34646)); + document.execCommand("contentReadOnly", false, null); + document.execCommand("removeformat", false, null); + document.execCommand("hilitecolor", false, "red"); + document.execCommand("inserthtml", false, "a"); + document.execCommand("delete", false, null); +} + +</script> +</head> + +<body onload="boom();"></body> + +</html> diff --git a/editor/libeditor/crashtests/713427-1.html b/editor/libeditor/crashtests/713427-1.html new file mode 100644 index 0000000000..21da24693a --- /dev/null +++ b/editor/libeditor/crashtests/713427-1.html @@ -0,0 +1,9 @@ +<span>
+<script contenteditable="true"></script>
+<blockquote>
+<input>
+<code style="display: table-row;">
+<html contenteditable="true">
+</blockquote>
+
+
diff --git a/editor/libeditor/crashtests/713427-2.xhtml b/editor/libeditor/crashtests/713427-2.xhtml new file mode 100644 index 0000000000..39ac18ed07 --- /dev/null +++ b/editor/libeditor/crashtests/713427-2.xhtml @@ -0,0 +1,28 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script> +<![CDATA[ + +function boom() +{ + while (document.documentElement.firstChild) { + document.documentElement.firstChild.remove(); + } + + var td = document.createElementNS("http://www.w3.org/1999/xhtml", "td"); + td.setAttributeNS(null, "contenteditable", "true"); + (document.documentElement).appendChild(td); + var head = document.createElementNS("http://www.w3.org/1999/xhtml", "head"); + (document.documentElement).appendChild(head); + + head.appendChild(td); +} + +window.addEventListener("load", boom); + +]]> +</script> +</head> + +<body></body> +</html> diff --git a/editor/libeditor/crashtests/716456-1.html b/editor/libeditor/crashtests/716456-1.html new file mode 100644 index 0000000000..a5ef5a2cc3 --- /dev/null +++ b/editor/libeditor/crashtests/716456-1.html @@ -0,0 +1,29 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<head> +<script> + +function boom() +{ + var div = document.querySelector("div"); + div.contentEditable = "true"; + div.focus(); + + var r = document.documentElement; + document["removeChild"](r); + document["appendChild"](r); + + setTimeout(function() { + getSelection().collapse(div, 0); + document.execCommand("inserthtml", false, "a"); + setTimeout(function() { + document.documentElement.removeAttribute("class"); + }, 0); + }, 0); +} + +</script> +</head> + +<body onload="boom();"><div></div></body> +</html> diff --git a/editor/libeditor/crashtests/745494.html b/editor/libeditor/crashtests/745494.html new file mode 100644 index 0000000000..ce15fc6363 --- /dev/null +++ b/editor/libeditor/crashtests/745494.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + document.getElementById("a").focus(); + document.execCommand("inserthtml", false, "<svg><td>"); + document.removeChild(document.documentElement); +} + +</script> +</head> + +<body onload="boom();"><div id="a" contenteditable="true"></div></body> +</html> diff --git a/editor/libeditor/crashtests/759748.html b/editor/libeditor/crashtests/759748.html new file mode 100644 index 0000000000..1e85a3877d --- /dev/null +++ b/editor/libeditor/crashtests/759748.html @@ -0,0 +1,58 @@ +<!doctype html> +<body> +<script> +var cmds = { + bold: "", + italic: "", + underline: "", + strikethrough: "", + subscript: "", + superscript: "", + cut: "", + copy: "", + paste: "", + delete: "", + forwarddelete: "", + selectall: "", + undo: "", + redo: "", + indent: "", + outdent: "", + backcolor: "#888888", + forecolor: "#888888", + hilitecolor: "#888888", + fontname: "Courier", + fontsize: "6", + increasefontsize: "", + decreasefontsize: "", + inserthorizontalrule: "", + createlink: "foo", + insertimage: "foo", + inserthtml: "foo", + inserttext: "foo", + insertparagraph: "", + gethtml: "", + justifyleft: "", + justifyright: "", + justifycenter: "", + justifyfull: "", + removeformat: "", + unlink: "", + insertorderedlist: "", + insertunorderedlist: "", + formatblock: "h1", + heading: "h1", + stylewithcss: "true", + usecss: "true", + contentreadonly: "true", + readonly: "true", + insertbronreturn: "true", + enableobjectresizing: "true", + enableinlinetableediting: "true", +}; +for (var k in cmds) { + document.body.innerHTML = "<div contenteditable>abc</div>"; + getSelection().removeAllRanges(); + try { document.execCommand(k, false, cmds[k]) } catch(e) {} +} +</script> diff --git a/editor/libeditor/crashtests/761861.html b/editor/libeditor/crashtests/761861.html new file mode 100644 index 0000000000..2a7e06a154 --- /dev/null +++ b/editor/libeditor/crashtests/761861.html @@ -0,0 +1,15 @@ +<!doctype html> +<script> +function boom() { + var r = document.documentElement; + while (r.firstChild) { + r.firstChild.remove(); + } + + document.documentElement.contentEditable = "true"; + document.documentElement.appendChild(document.createElement("span")); + document.documentElement.firstChild.appendChild(document.createTextNode("_")); + document.execCommand("forwarddelete"); +} +</script> +<body onload="boom()"> diff --git a/editor/libeditor/crashtests/762183.html b/editor/libeditor/crashtests/762183.html new file mode 100644 index 0000000000..1916ac6fb5 --- /dev/null +++ b/editor/libeditor/crashtests/762183.html @@ -0,0 +1,6 @@ +<body contenteditable=true>x y +<script> +document.body.firstChild.splitText(2).splitText(1).splitText(1); +getSelection().collapse(document.body, 1); +document.execCommand("forwardDelete", false, null); +</script> diff --git a/editor/libeditor/crashtests/766305.html b/editor/libeditor/crashtests/766305.html new file mode 100644 index 0000000000..a5000fe738 --- /dev/null +++ b/editor/libeditor/crashtests/766305.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var s = "x"; + for (var i = 0; i < 15; ++i) + s = s + s; + var t = document.createTextNode(s); + document.body.appendChild(t); + window.getSelection().collapse(t, s.length); + document.execCommand("insertText", false, "a"); +} + +</script> +</head> + +<body contenteditable="true" onload="boom();"></body> +</html> diff --git a/editor/libeditor/crashtests/766360.html b/editor/libeditor/crashtests/766360.html new file mode 100644 index 0000000000..76c30456d6 --- /dev/null +++ b/editor/libeditor/crashtests/766360.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var r = document.createRange(); + r.setEnd(document.createTextNode("x"), 0); + window.getSelection().addRange(r); + document.execCommand("inserthtml", false, "y"); +} + +</script> +</head> + +<body contenteditable="true" onload="boom();"></body> +</html> diff --git a/editor/libeditor/crashtests/766387.html b/editor/libeditor/crashtests/766387.html new file mode 100644 index 0000000000..20ccc60d44 --- /dev/null +++ b/editor/libeditor/crashtests/766387.html @@ -0,0 +1,20 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + window.getSelection().removeAllRanges(); + var r = document.createRange(); + r.setStart(document.getElementById("x"), 1); + r.setEnd(document.getElementById("y"), 0); + window.getSelection().addRange(r); + document.execCommand("insertorderedlist", false, null); +} + +</script> +</head> + +<body onload="boom();"><div id="x" contenteditable="true">a</div><div id="y" contenteditable="true"></div></body> +</html> diff --git a/editor/libeditor/crashtests/766413.html b/editor/libeditor/crashtests/766413.html new file mode 100644 index 0000000000..1a7092d92a --- /dev/null +++ b/editor/libeditor/crashtests/766413.html @@ -0,0 +1,42 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var root = document.documentElement; + while (root.firstChild) { + root.firstChild.remove(); + } + + var space = document.createTextNode(" "); + var body = document.createElementNS("http://www.w3.org/1999/xhtml", "body"); + root.contentEditable = "true"; + root.focus(); + document.execCommand("contentReadOnly", false, null); + root.appendChild(body); + root.contentEditable = "false"; + root.appendChild(space); + root.removeChild(body); + root.contentEditable = "true"; + + window.getSelection().removeAllRanges(); + var r1 = document.createRange(); + r1.setStart(root, 0); + r1.setEnd(root, 0); + window.getSelection().addRange(r1); + looseText = document.createTextNode("c"); + var r2 = document.createRange(); + r2.setStart(looseText, 0); + r2.setEnd(looseText, 0); + window.getSelection().addRange(r2); + + document.execCommand("forwardDelete", false, null); +} + +</script> +</head> + +<body onload="boom();"></body> +</html> diff --git a/editor/libeditor/crashtests/766795.html b/editor/libeditor/crashtests/766795.html new file mode 100644 index 0000000000..b4ade30209 --- /dev/null +++ b/editor/libeditor/crashtests/766795.html @@ -0,0 +1,21 @@ +<html> +<head> +<script> + +function boom() +{ + var fragEl = document.createElement("span"); + fragEl.setAttribute("contenteditable", "true"); + fragEl.setAttribute("style", "position: absolute;"); + + var frag = document.createDocumentFragment(); + frag.appendChild(fragEl); + + window.getSelection().selectAllChildren(fragEl); +} + +</script> +</head> + +<body contenteditable="true" onload="boom();"></body> +</html> diff --git a/editor/libeditor/crashtests/766845.xhtml b/editor/libeditor/crashtests/766845.xhtml new file mode 100644 index 0000000000..409e210109 --- /dev/null +++ b/editor/libeditor/crashtests/766845.xhtml @@ -0,0 +1,27 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script> +<![CDATA[ + +function boom() +{ + window.getSelection().removeAllRanges(); + var r1 = document.createRange(); + r1.setStart(document.body, 0); + r1.setEnd (document.body, 1); + window.getSelection().addRange(r1); + var r2 = document.createRange(); + r2.setStart(document.body, 1); + r2.setEnd (document.body, 2); + window.getSelection().addRange(r2); + if (document.queryCommandEnabled("inserthtml")) + document.execCommand("inserthtml", false, "1"); +} + +]]> +</script> +</head> + +<body contenteditable="true" onload="boom();"><div></div><div></div></body> + +</html> diff --git a/editor/libeditor/crashtests/767169.html b/editor/libeditor/crashtests/767169.html new file mode 100644 index 0000000000..a7673bce62 --- /dev/null +++ b/editor/libeditor/crashtests/767169.html @@ -0,0 +1,23 @@ +<html> +<head> +<script> + +// Document must not have a doctype to trigger the bug + +function boom() +{ + var root = document.documentElement; + while (root.firstChild) { root.firstChild.remove(); } + root.contentEditable = "true"; + document.removeChild(root); + document.appendChild(root); + window.getSelection().collapse(root, 0); + window.getSelection().extend(document, 1); + document.removeChild(root); +} + +</script> +</head> + +<body onload="boom();"></body> +</html> diff --git a/editor/libeditor/crashtests/768748.html b/editor/libeditor/crashtests/768748.html new file mode 100644 index 0000000000..09206dce3f --- /dev/null +++ b/editor/libeditor/crashtests/768748.html @@ -0,0 +1,16 @@ +<!DOCTYPE html> +<html contenteditable="true"> +<head> +<script> + +function boom() +{ + var looseText = document.createTextNode("x"); + window.getSelection().collapse(looseText, 0); + document.queryCommandState("insertorderedlist"); +} + +</script> +</head> +<body onload="setTimeout(boom, 0)"></body> +</html> diff --git a/editor/libeditor/crashtests/768765.html b/editor/libeditor/crashtests/768765.html new file mode 100644 index 0000000000..551e4ec6c3 --- /dev/null +++ b/editor/libeditor/crashtests/768765.html @@ -0,0 +1,36 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var root = document.documentElement; + + while (root.firstChild) { root.firstChild.remove(); } + + var body = document.createElementNS("http://www.w3.org/1999/xhtml", "body"); + var div = document.createElementNS("http://www.w3.org/1999/xhtml", "div"); + root.contentEditable = "true"; + root.appendChild(div); + root.removeChild(div); + root.insertBefore(body, root.firstChild); + + window.getSelection().removeAllRanges(); + var r0 = document.createRange(); + r0.setStart(body, 0); + r0.setEnd(body, 0); + window.getSelection().addRange(r0); + var r1 = document.createRange(); + r1.setStart(div, 0); + r1.setEnd(div, 0); + window.getSelection().addRange(r1); + + document.execCommand("inserthtml", false, "1"); +} + +</script> +</head> + +<body onload="boom();"></body> +</html> diff --git a/editor/libeditor/crashtests/769008-1.html b/editor/libeditor/crashtests/769008-1.html new file mode 100644 index 0000000000..8ea8a3601d --- /dev/null +++ b/editor/libeditor/crashtests/769008-1.html @@ -0,0 +1,23 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var x = document.getElementById("x"); + + window.getSelection().removeAllRanges(); + + var range = document.createRange(); + range.setStart(x, 0); + range.setEnd(x, 0); + window.getSelection().addRange(range); + + document.execCommand("delete", false, "null"); +} + +</script> +</head> +<body contenteditable="true" onload="boom();"><div></div><span id="x"></span></body> +</html> diff --git a/editor/libeditor/crashtests/769967.xhtml b/editor/libeditor/crashtests/769967.xhtml new file mode 100644 index 0000000000..af07571591 --- /dev/null +++ b/editor/libeditor/crashtests/769967.xhtml @@ -0,0 +1,16 @@ +<html xmlns="http://www.w3.org/1999/xhtml" contenteditable="true" style="user-select: all;"><sub>x</sub><script> +function boom() +{ + window.getSelection().removeAllRanges(); + var r = document.createRange(); + r.setStart(document.documentElement, 0); + r.setEnd(document.documentElement, 0); + window.getSelection().addRange(r); + + document.execCommand("subscript", false, null); + document.execCommand("insertText", false, "y"); +} + +window.addEventListener("load", boom, false); + +</script></html> diff --git a/editor/libeditor/crashtests/771749.html b/editor/libeditor/crashtests/771749.html new file mode 100644 index 0000000000..9237364f2d --- /dev/null +++ b/editor/libeditor/crashtests/771749.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var root = document.documentElement; + root.contentEditable = "true"; + document.removeChild(root); + document.appendChild(root); + document.execCommand("insertunorderedlist", false, null); + document.execCommand("inserthtml", false, "<span></span>"); + document.execCommand("outdent", false, null); +} + +</script> +</head> + +<body onload="boom();"></body> +</html> diff --git a/editor/libeditor/crashtests/772282.html b/editor/libeditor/crashtests/772282.html new file mode 100644 index 0000000000..bba3d6bd67 --- /dev/null +++ b/editor/libeditor/crashtests/772282.html @@ -0,0 +1,27 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var root = document.documentElement; + while(root.firstChild) { root.firstChild.remove(); } + var body = document.createElementNS("http://www.w3.org/1999/xhtml", "body"); + body.setAttributeNS(null, "contenteditable", "true"); + var img = document.createElementNS("http://www.w3.org/1999/xhtml", "img"); + body.appendChild(img); + root.appendChild(body); + document.removeChild(root); + document.appendChild(root); + document.execCommand("insertText", false, "5"); + document.execCommand("selectAll", false, null); + document.execCommand("insertParagraph", false, null); + document.execCommand("increasefontsize", false, null); +} + +</script> +</head> + +<body onload="boom();"></body> +</html> diff --git a/editor/libeditor/crashtests/776323.html b/editor/libeditor/crashtests/776323.html new file mode 100644 index 0000000000..9fc2776c37 --- /dev/null +++ b/editor/libeditor/crashtests/776323.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html contenteditable="true"> +<head> +<script> + +function boom() +{ + document.execCommand("inserthtml", false, "b"); + var myrange = document.createRange(); + myrange.selectNodeContents(document.getElementsByTagName("img")[0]); + window.getSelection().addRange(myrange); + document.execCommand("strikethrough", false, null); +} + +</script> +</head> +<body onload="boom();"><img></body> +</html> diff --git a/editor/libeditor/crashtests/793866.html b/editor/libeditor/crashtests/793866.html new file mode 100644 index 0000000000..4984474dbc --- /dev/null +++ b/editor/libeditor/crashtests/793866.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var b = document.body; + b.contentEditable = "true"; + document.execCommand("contentReadOnly", false, null); + b.focus(); + b.contentEditable = "false"; + document.documentElement.contentEditable = "true"; + document.createDocumentFragment().appendChild(b); + document.documentElement.focus(); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/editor/libeditor/crashtests/848644.html b/editor/libeditor/crashtests/848644.html new file mode 100644 index 0000000000..95570fabe3 --- /dev/null +++ b/editor/libeditor/crashtests/848644.html @@ -0,0 +1,2 @@ +<!DOCTYPE html> +<iframe src="data:text/html;charset=utf-8;base64,PGh0bWw+CjxoZWFkPgoJPHNjcmlwdD4KCQoJCXZhciBuID0gMDsKCQkKICAgICAgICB2YXIgU3ByYXkgPSBbXTsgICAgICAgICAgICAKICAgICAgICB2YXIgblNwcmF5ID0gMHgxMDA7ICAgICAgICAKCiAgICAKICAgIGZ1bmN0aW9uIHB0clRvU3RyaW5nKHB0cikKICAgIHsKICAgICAgICB2YXIgdGVtcCA9IHB0ci50b1N0cmluZygxNik7CiAgICAgICAgd2hpbGUgKHRlbXAubGVuZ3RoIDwgOCkKICAgICAgICAgICAgdGVtcCA9ICIwIiArIHRlbXA7CiAgICAgICAgYWQgPSAiJXUiOwogICAgICAgIGZvciAodmFyIGk9MDsgaTw0OyBpKyspCiAgICAgICAgICAgIGFkID0gYWQgKyB0ZW1wLmNoYXJBdCg0K2kpOwogICAgICAgIGFkICs9ICIldSI7CiAgICAgICAgZm9yICh2YXIgaT0wOyBpPDQ7IGkrKykKICAgICAgICAgICAgYWQgPSBhZCArIHRlbXAuY2hhckF0KGkpOwogICAgICAgIHJldHVybiBhZDsKICAgIH0KCiAgICAgICBmdW5jdGlvbiBzcHJheU1lbW9yeSgpCiAgICB7CiAgICAgICAgdmFyIHBhZ2Vfc2l6ZSA9IDB4MTAwMDAwIC0gMHgxMDAwOwogICAgICAgIHZhciBibG9jayA9ICIiOwoKICAgICAgICB3aGlsZSAoYmxvY2subGVuZ3RoICogMiA8IDB4MEM0KzB4MjAyMCkKICAgICAgICAgICAgYmxvY2sgKz0gcGFjaygweDkwOTA5MDkwKTsKICAgICAgICAKICAgICAgICB3aGlsZSAoYmxvY2subGVuZ3RoICogMiA8IHBhZ2Vfc2l6ZSkKICAgICAgICAgICAgYmxvY2sgKz0gIlx1OTA5MFx1OTA5MCI7CiAgICAgICAgICAgIAogICAgICAgIHZhciBzcHIgPSBibG9jay5zdWJzdHJpbmcoMCwgcGFnZV9zaXplIC8gMik7CiAgICAgICAgCiAgICAgICAgZm9yICh2YXIgaSA9IDA7IGkgPCBuU3ByYXk7IGkrKykKICAgICAgICAgICAgU3ByYXlbaV0gPSBbc3ByXS5qb2luKCIiKTsKICAgIH0KICAgICAgICAKCQlmdW5jdGlvbiBwYWNrKGEpCgkJewoJCQlyZXR1cm4gU3RyaW5nLmZyb21DaGFyQ29kZShhICYgMHhGRkZGKSArIFN0cmluZy5mcm9tQ2hhckNvZGUoYSA+PiAxNik7CgkJfQoJCQoJCXZhciAkID0gZnVuY3Rpb24oaWQpIHsgcmV0dXJuIGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKGlkKTsgfQoJCQoJCXZhciBhbGxvYyA9IGZ1bmN0aW9uKHN6LCBwYXR0ZXJuPSdcdTQxNDEnKQoJCXsKCQkJc3ogLT0gMjsKCQkJaWYgKHN6IDwgMCkKCQkJCXJldHVybiBudWxsOwoJCQkKCQkJdmFyIHN0ciA9IHBhdHRlcm47CgkJCXdoaWxlIChzdHIubGVuZ3RoICogMiA8IHN6KQoJCQkJc3RyICs9IHBhdHRlcm47CgkJCgkJCXJldHVybiBzdHIuc3Vic3RyaW5nKDAsIHN6LzIpOwoJCX0KCQkKCQlmdW5jdGlvbiBhcHBlbmRJbnB1dChuLCB3aXRoSWRzPWZhbHNlKSAKCQl7CgkJCXZhciBib2R5ID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiYm9keSIpCgkJCXZhciBibG9jayA9IHBhY2soMHgyMDIwMjAyMCk7CgkJCXdoaWxlIChibG9jay5sZW5ndGggKiAyIDwgMHg1NCkKCQkJCWJsb2NrICs9IHBhY2soMHgyMDIwMjAyMCk7CgkJCWJsb2NrICs9IHBhY2soMHgyMDIwMjAyMCk7CgkJCXdoaWxlIChibG9jay5sZW5ndGggKiAyIDwgMHhDNCkKCQkJCWJsb2NrICs9IHBhY2soMHgyMDIwMjAyMCk7CgkJCWJsb2NrICs9IHBhY2soMHgyMDIwMjAyMCk7CgkJCXdoaWxlIChibG9jay5sZW5ndGggKiAyIDwgMHgyRDQgLSAyKQoJCQkJYmxvY2sgKz0gcGFjaygweDIwMjAyMDIwKTsKCQkgICAgdmFyIGIgPSBibG9jay5zdWJzdHJpbmcoMCwgMHgyRDIpOwoJCQlmb3IgKHZhciBpID0wOyBpPG47IGkrKykgCgkJCXsKCQkJCXZhciBpbnB1dCA9IGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoJ2lucHV0JykKCQkJCWlmICh3aXRoSWRzID09IHRydWUpCgkJCQkJaW5wdXQuc2V0QXR0cmlidXRlKCdpZCcsICdpbnB1dCcgKyBpKTsKCQkJCWlucHV0LnZhbHVlID0gYgoJCQkJZG9jdW1lbnQuYm9keS5hcHBlbmRDaGlsZChpbnB1dCkKCQkJfQoJCX0KCQkKCQlmdW5jdGlvbiBjcmFmdEhlYXAobikKCQl7CgkJCWFwcGVuZElucHV0KG4sIHRydWUpOwoJCQlmb3IgKHZhciBpID0gMDsgaSA8IG47IGkgKz0gMikKCQkJCWRvY3VtZW50LmJvZHkucmVtb3ZlQ2hpbGQoJCgnaW5wdXQnICsgaSkpOwoJCX0KCQkKCQlmdW5jdGlvbiBzdGFydEZ1bigpCgkJewogICAgICAgICAgICAgICAgICAgICAgICBkb2N1bWVudC5kb2N1bWVudEVsZW1lbnQuZ2V0Qm91bmRpbmdDbGllbnRSZWN0KCk7CgkJCWNyYWZ0SGVhcCgweDEwKTsKCQkJZG9jdW1lbnQuZGVzaWduTW9kZSA9ICJvbiI7CgkJCWRvY3VtZW50LmRvY3VtZW50RWxlbWVudC5zdHlsZS5oZWlnaHQgPSAiMjAwcHgiOwoJCQkkKCdpZDEnKS5vZmZzZXRUb3A7CgkJfQoJCQoJCQoJCWZ1bmN0aW9uIGNhbGNNZUJhYmUoKQoJCXsKCQkJbisrOwoJCQlkb2N1bWVudC5leGVjQ29tbWFuZCgiaW5zZXJ0T3JkZXJlZExpc3QiLGZhbHNlLHRydWUpOwoJCQlkb2N1bWVudC53cml0ZSgnQUFBQUFBQUFBQUFBJyk7CQkKICAgICAgICAgICAgc3ByYXlNZW1vcnkoKTsKCQkJYXBwZW5kSW5wdXQoMHgxMDApOwoJCQkKCQkJZG9jdW1lbnQuZG9jdW1lbnRFbGVtZW50LnN0eWxlLmhlaWdodCA9ICIzMDBweCI7CgkJCWlmIChuID09IDIpCgkJCXsKICAgICAgICAgICAgICAgIHdpbmRvdy5yZW1vdmVFdmVudExpc3RlbmVyKCJyZXNpemUiLCBjYWxjTWVCYWJlLCBmYWxzZSk7CgkJCQloaXN0b3J5LmdvKC0xKTsKCQkJfQoKCQl9CgkJd2luZG93LmFkZEV2ZW50TGlzdGVuZXIoInJlc2l6ZSIsIGNhbGNNZUJhYmUsIGZhbHNlKTsKCTwvc2NyaXB0Pgo8L2hlYWQ+Cgk8Ym9keT4KCQk8ZGl2IGlkPSdpZDEnPiAgICA8L2Rpdj4KCQk8c2NyaXB0PnN0YXJ0RnVuKCk7PC9zY3JpcHQ+Cgk8L2JvZHk+CjwvaHRtbD4K" style="width: 100px; height: 100px"></iframe> diff --git a/editor/libeditor/crashtests/crashtests.list b/editor/libeditor/crashtests/crashtests.list new file mode 100644 index 0000000000..db7036e605 --- /dev/null +++ b/editor/libeditor/crashtests/crashtests.list @@ -0,0 +1,138 @@ +load 336081-1.xhtml +load 336104.html +load 382527-1.html +load 382778-1.html +load 402172-1.html +load 403965-1.xhtml +load 407074-1.html +load 407079-1.html +load 407256-1.html +load 407277-1.html +load 414178-1.html +load 418923-1.html +load 420439.html +load 428489-1.html +load 429586-1.html +load 430624-1.html +load 431086-1.xhtml +load 448329-1.html +load 448329-2.html +load 448329-3.html +load 456727-1.html +load 456727-2.html +load 459613.html +needs-focus load 467647-1.html +load 475132-1.xhtml +load 499844-1.html +load 503709-1.xhtml +load 513375-1.xhtml +load 535632-1.xhtml +load 574558-1.xhtml +load 580151-1.xhtml +load 582138-1.xhtml +load 612565-1.html +load 615015-1.html +load 615450-1.html +load 633709.xhtml +load 636074-1.html +load 639736-1.xhtml +load 643786-1.html +load 650572-1.html +load 667321-1.html +load 682650-1.html +load 713427-1.html +load 713427-2.xhtml +load 716456-1.html +needs-focus load 745494.html +load 759748.html +load 761861.html +load 762183.html +load 766305.html +load 766360.html +load 766387.html +load 766413.html +load 766795.html +load 766845.xhtml +load 767169.html +load 768748.html +load 768765.html +load 769008-1.html +load 769967.xhtml +needs-focus load 771749.html +load 772282.html +load 776323.html +needs-focus load 793866.html +load 848644.html +load 1057677.html +needs-focus load 1128787.html +load 1134545.html +load 1158452.html +load 1158651.html +load 1244894.xhtml +load 1264921.html +load 1272490.html +load 1274050.html +load 1317704.html +load 1317718.html +load 1324505.html +needs-focus load 1343918.html +load 1344097.html +load 1345015.html +load 1348851.html +load 1350772.html +load 1364133.html +load 1366176.html +asserts(4) load 1375131.html # assertion in WSRunScanner::GetEditableBlockParentOrTopmotEditableInlineContent() +load 1381541.html +load 1383747.html +load 1383755.html +load 1383763.html +load 1384161.html +load 1388075.html +load 1393171.html +needs-focus load 1402196.html +load 1402469.html +load 1402526.html +pref(dom.document.exec_command.nested_calls_allowed,true) asserts(1) load 1402904.html # assertion is that mutation event listener caused by execCommand calls another execCommand +pref(dom.document.exec_command.nested_calls_allowed,true) asserts(1) load 1405747.html # assertion is that mutation event listener caused by execCommand calls another execCommand +load 1405897.html +asserts(4) load 1408170.html # 4: assertion in WSRunScanner::GetEditableBlockParentOrTopmotEditableInlineContent() +asserts(0-1) load 1414581.html +load 1415231.html +load 1423767.html +needs-focus load 1423776.html +needs-focus load 1424450.html +load 1425091.html +load 1426709.html +load 1441619.html +load 1443664.html +skip-if(Android) needs-focus load 1444630.html +load 1446451.html +pref(dom.document.exec_command.nested_calls_allowed,true) asserts(2) load 1464251.html # assertion is that mutation event listener caused by execCommand calls another execCommand +pref(layout.accessiblecaret.enabled,true) load 1470926.html +pref(dom.document.exec_command.nested_calls_allowed,true) asserts(1) load 1474978.html # assertion is that mutation event listener caused by execCommand calls another execCommand +load 1525481.html +load 1533913.html +asserts(3) load 1534394.html # assertion in WSRunScanner::GetEditableBlockParentOrTopmotEditableInlineContent() +load 1547897.html +load 1547898.html +load 1556799.html +load 1579934.html +load 1574544.html +load 1578916.html +load 1581246.html +load 1596516.html +load 1605741.html +load 1613521.html +load 1618906.html +load 1623913.html +load 1624005.html # throws +load 1624007.html +load 1624011.html +load 1644903.html +load 1645983-1.html +load 1645983-2.html +load 1648564.html +load 1659717.html +load 1663725.html # throws +pref(dom.document.exec_command.nested_calls_allowed,true) load 1666556.html |