diff options
| author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-28 14:29:10 +0000 |
|---|---|---|
| committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-28 14:29:10 +0000 |
| commit | 2aa4a82499d4becd2284cdb482213d541b8804dd (patch) | |
| tree | b80bf8bf13c3766139fbacc530efd0dd9d54394c /layout/painting/crashtests | |
| parent | Initial commit. (diff) | |
| download | firefox-upstream.tar.xz firefox-upstream.zip | |
Adding upstream version 86.0.1.upstream/86.0.1upstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'layout/painting/crashtests')
27 files changed, 536 insertions, 0 deletions
diff --git a/layout/painting/crashtests/1402183-1.html b/layout/painting/crashtests/1402183-1.html new file mode 100644 index 0000000000..ea54512894 --- /dev/null +++ b/layout/painting/crashtests/1402183-1.html @@ -0,0 +1,20 @@ +<!DOCTYPE html> +<html> +<head> +<title>Bug 1402183</title> +<style type="text/css"> +:not(article) { + -webkit-text-stroke-width: 1px; + box-decoration-break: clone; + clip-path: polygon(69px 1px, 49px 1px, 0px 0px); +} +</style> +</head> +<body> +<ins> +<p> +r6O#i/q] +</p> +</ins> +</body> +</html> diff --git a/layout/painting/crashtests/1405881-1.html b/layout/painting/crashtests/1405881-1.html new file mode 100644 index 0000000000..44c8ab1ac0 --- /dev/null +++ b/layout/painting/crashtests/1405881-1.html @@ -0,0 +1,24 @@ +<style type="text/css">
+ #container {
+ height: 300px;
+ width: 300px;
+ }
+ #box {
+ height: 100px;
+ width: 100px;
+ background: red;
+ animation: 2s anim;
+ }
+ @keyframes anim {
+ from {
+ -moz-transform: matrix3d(1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 10%, 10%, 0, 1);
+ }
+ to {
+ -moz-transform: matrix3d(1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 40%, 40%, 0, 1);
+ }
+ }
+
+</style>
+<div id=container>
+ <div id=box></div>
+</div>
diff --git a/layout/painting/crashtests/1407470-1.html b/layout/painting/crashtests/1407470-1.html new file mode 100644 index 0000000000..0ddf957182 --- /dev/null +++ b/layout/painting/crashtests/1407470-1.html @@ -0,0 +1,19 @@ +<body id='test_body'> +<script> +let o = []; +o[0] = document.createElement("tt"); +test_body.appendChild(o[0]); +o[1] = document.createElement("center"); +o[2] = document.createElement("footer"); +o[0].appendChild(o[2]); +o[1].animate([{ + "padding": "80.40vw 0.0vmax", + "transform": "matrix(6287.56,268.76,237.34,222.80,186.72,287.94) rotateX(2.046rad)" + }], { duration:3845.75 }); +o[2].appendChild(o[1]); +test_body.animate([{ + "transform": "scale3d(0.0,5961462.820,250.41)", + "outline": "auto thick", + "mask": "exclude no-clip url(data:image/gif;base64,R0lGODlhAQABAAD/ACH/C05FVFNDQVBFMi4wAwEAAAAsAAAAAAEAAQAAAgAsAAAAAAEAAQAAAgA7),exclude", + }], 3617.63433129); +</script>
\ No newline at end of file diff --git a/layout/painting/crashtests/1413073-1.html b/layout/painting/crashtests/1413073-1.html new file mode 100644 index 0000000000..ddecfb2424 --- /dev/null +++ b/layout/painting/crashtests/1413073-1.html @@ -0,0 +1,15 @@ +<html class="reftest-wait"> +<body> +<div style="position:fixed; width:200px; height:200px; background-color:blue"> + <div style="position:fixed; width:200px; height:200px; left:400px; background-color:red" id="inner"></div> +</div> +</body> +<script> + function doTest() { + var d = document.getElementById("inner"); + d.style.backgroundColor = "green"; + document.documentElement.className = ""; + } + window.addEventListener("MozReftestInvalidate", doTest); +</script> +</html> diff --git a/layout/painting/crashtests/1413073-2.html b/layout/painting/crashtests/1413073-2.html new file mode 100644 index 0000000000..01d1718745 --- /dev/null +++ b/layout/painting/crashtests/1413073-2.html @@ -0,0 +1,18 @@ +<html class="reftest-wait"> +<body> +<div style="position:absolute; width:200px; height:200px; opacity:0.5"> + <div style="opacity:0.9"> + <div style="position:fixed; width:200px; height:200px; left:400px; background-color:blue" id="fixed"></div> + </div> + <div style="width:200px; height:200px; background-color:red" id="inner"></div> +</div> +</body> +<script> + function doTest() { + var d = document.getElementById("inner"); + d.style.backgroundColor = "green"; + document.documentElement.className = ""; + } + window.addEventListener("MozReftestInvalidate", doTest); +</script> +</html> diff --git a/layout/painting/crashtests/1418177-1.html b/layout/painting/crashtests/1418177-1.html new file mode 100644 index 0000000000..6420814bce --- /dev/null +++ b/layout/painting/crashtests/1418177-1.html @@ -0,0 +1,34 @@ +<html> + <head> + <style> + * { + background: url(16.png), url(16.png) transparent; + -webkit-background-clip: text, text; + -moz-tab-size: calc(1 + 1) !important; + background-blend-mode: screen; + align-content: baseline; + background-color: green; + } + </style> + <script> + function fun_0() { + try { o3 = document.createElement('th') } catch (e) {}; + try { o1.appendChild(o3) } catch (e) {} + } + + try { o1 = document.createElement('tr') } catch (e) {} + try { o2 = document.createElement('ol') } catch (e) {} + try { xhr = new XMLHttpRequest({mozAnon: false }) } catch (e) {} + try { document.documentElement.appendChild(o1) } catch (e) {} + try { document.documentElement.appendChild(o2) } catch (e) {} + for (let i = 0; i < 100; i++) { + try { xhr.open('GET', 'data:text/html,1', false); } catch (e) {}; + try { xhr.send(); } catch (e) {}; + try { fuzzPriv.GC(); fuzzPriv.CC(); fuzzPriv.GC(); fuzzPriv.CC(); } catch (e) {}; + try { xhr.addEventListener('readystatechange', fun_0, true) } catch (e) {}; + try { o2.offsetLeft } catch (e) {}; + try { document.styleSheets[0].cssRules[0].style['background-origin'] = 'border-box, border-box' } catch (e) {} + } + </script> + </head> +</html> diff --git a/layout/painting/crashtests/1418722-1.html b/layout/painting/crashtests/1418722-1.html new file mode 100644 index 0000000000..93415d3012 --- /dev/null +++ b/layout/painting/crashtests/1418722-1.html @@ -0,0 +1,17 @@ +<html class="reftest-wait"> +<body> + <div style="width:200px; height:200px; perspective:1000px"> + <div style="width:200px; height:200px; transform:translateZ(2px); background-color:green" id="transformed"></div> + </div> + <div style="width: 200px; height:200px; background-color:red" id="helper"></div> +</body> +<script> + function doTest() { + var element = document.getElementById("transformed"); + element.parentNode.removeChild(element); + document.getElementById("helper").style.backgroundColor = "blue"; + document.documentElement.className = ""; + } + window.addEventListener("MozReftestInvalidate", doTest); +</script> +</html> diff --git a/layout/painting/crashtests/1419917.html b/layout/painting/crashtests/1419917.html new file mode 100644 index 0000000000..a60dd15403 --- /dev/null +++ b/layout/painting/crashtests/1419917.html @@ -0,0 +1,15 @@ +<html> + <head> + <style> + :nth-last-child(2) { -moz-appearance:listbox } + </style> + <script> + try { o1 = document.createElement('tr') } catch(e) { } + try { o2 = document.createElement('th') } catch(e) { } + try { o3 = document.createElement('canvas') } catch(e) { } + try { document.documentElement.appendChild(o1) } catch(e) { } + try { o1.appendChild(o2) } catch(e) { } + try { o1.appendChild(o3) } catch(e) { } + </script> + </head> +</html> diff --git a/layout/painting/crashtests/1425271-1.html b/layout/painting/crashtests/1425271-1.html new file mode 100644 index 0000000000..164cb0f11f --- /dev/null +++ b/layout/painting/crashtests/1425271-1.html @@ -0,0 +1,54 @@ +<!DOCTYPE html> +<html class="reftest-wait"> + +<head> + <meta http-equiv="content-type" content="text/html; charset=UTF-8"> + <meta charset="utf-8"> +</head> + +<body> +<div id="container"> + <div id="element"> + <!-- + The HTML code for this element has no other meaning than to create + display items that are merged together. + --> + <div style="column-count:2; column-count:2; width:300px; height:100px;"> + <div id="o" style="opacity:0.5; width:100px; height:200px; background:lime;"> + <div id="d" style="height:50px; width:80px; background:red; padding:2px">Text</div> + </div> + </div> + </div> +</div> + +<script type="text/javascript"> +function redirect() { + document.documentElement.removeAttribute("class"); + + // Trigger root frame deletion. + window.location.replace("about:blank"); +} + +function removeElements(container) { + document.body.removeChild(container); + + setTimeout(redirect, 0); +} + +function createElements() { + var c = document.getElementById("container"); + var e = document.getElementById("element"); + for (var i = 0; i < 1000; ++i) { + // Populate the container with elements that cause display item merges. + c.appendChild(e.cloneNode(true)); + } + + setTimeout(() => removeElements(c), 0); +} + +document.addEventListener("MozReftestInvalidate", createElements); +// window.addEventListener("load", createElements); +</script> + +</body> +</html> diff --git a/layout/painting/crashtests/1428906-1.html b/layout/painting/crashtests/1428906-1.html new file mode 100644 index 0000000000..03e6d3aaf8 --- /dev/null +++ b/layout/painting/crashtests/1428906-1.html @@ -0,0 +1,16 @@ +<html><head> +<meta http-equiv="content-type" content="text/html; charset=UTF-8"><style> +*,m{background:url()repeat center top fixed} +#a{transform:scale(1)} +</style> +<script> +function eh1(){ + try{c=a.insertRow()}catch(e){} + try{c.appendChild(b)}catch(e){} +} +</script> +</head><body><table id="a"> +<tbody><tr><d id="b"> +<video> +<source onerror="eh1()"> +</video></d></tr></tbody></table></body></html> diff --git a/layout/painting/crashtests/1430589-1.html b/layout/painting/crashtests/1430589-1.html new file mode 100644 index 0000000000..88bb0494a7 --- /dev/null +++ b/layout/painting/crashtests/1430589-1.html @@ -0,0 +1,55 @@ +<html class="reftest-wait"><head> +<meta http-equiv="content-type" content="text/html; charset=UTF-8"> + <style> + :root { + flex-wrap: wrap-reverse; + } + menuitem { + -webkit-mask-image: url(data:image/gif;base64,R0lGODlhEAAQAMQAAORHHOVSKudfOulrSOp3WOyDZu6QdvCchPGolfO0o/XBs/fNwfjZ0frl3/zy7////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAkAABAALAAAAAAQABAAAAVVICSOZGlCQAosJ6mu7fiyZeKqNKToQGDsM8hBADgUXoGAiqhSvp5QAnQKGIgUhwFUYLCVDFCrKUE1lBavAViFIDlTImbKC5Gm2hB0SlBCBMQiB0UjIQA7); + } + + * { + margin-right: -1px; + display: -webkit-box; + overflow: scroll; + } + + + .css1 { + -webkit-border-bottom-left-radius: 10px; + } + + + </style> +<script> +function BOOM(){ + setTimeout(() => { + var elem = document.getElementById("vuln"); + elem.style.width = 600; + elem.style.height = 600; + window.requestAnimationFrame(() => { + window.requestAnimationFrame(() => { + document.documentElement.removeAttribute("class"); + }); + }); + }, 0); +} + +document.addEventListener("MozReftestInvalidate", BOOM); +//window.addEventListener("load", BOOM); +</script></head> + +<body> + <footer> + <textarea id="vuln" style="width: 500px; height: 500px;">Ashitaka</textarea> + </footer> + <menu> + <menuitem> + <iframe></iframe> + </menuitem></menu> + <menuitem> + <hr> + <dialog class="css1"></dialog> + + +</menuitem></body></html> diff --git a/layout/painting/crashtests/1454105-1.html b/layout/painting/crashtests/1454105-1.html new file mode 100644 index 0000000000..946d45992b --- /dev/null +++ b/layout/painting/crashtests/1454105-1.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<style> +#a { + filter: brightness(1); + border-style: solid; +} +#b { + opacity: 0.2; +} +</style> +</head> +<body> +<span id="b"> + <span id="a"> + <div></div> + </span> +</span> +</body> +</html> diff --git a/layout/painting/crashtests/1455944-1.html b/layout/painting/crashtests/1455944-1.html new file mode 100644 index 0000000000..c115f4dd8e --- /dev/null +++ b/layout/painting/crashtests/1455944-1.html @@ -0,0 +1,14 @@ +<!DOCTYPE html> +<html> +<head> +<meta http-equiv="content-type" content="text/html; charset=UTF-8"> +<meta charset="utf-8"> +</head> + +<body> +<div style="opacity: 0.9;"> + <iframe style="border: none;" src=""></iframe> +</div> + +</body> +</html> diff --git a/layout/painting/crashtests/1458145.html b/layout/painting/crashtests/1458145.html new file mode 100644 index 0000000000..dc5f07c204 --- /dev/null +++ b/layout/painting/crashtests/1458145.html @@ -0,0 +1,11 @@ +<style> +* { position: fixed; } +#a { +perspective: 0px; +overflow: scroll; +} +.cl2 { -webkit-transform-style: preserve-3d; } +.cl1 { border-bottom-right-radius: 0px 1px; } +</style> +<del id="a" class="cl1"> +<dl class="cl2">#_k</dl> diff --git a/layout/painting/crashtests/1465305-1.html b/layout/painting/crashtests/1465305-1.html new file mode 100644 index 0000000000..084f524fba --- /dev/null +++ b/layout/painting/crashtests/1465305-1.html @@ -0,0 +1,8 @@ +<style> +:not(cursor) { + -webkit-background-clip: text; + border-top-right-radius: 0vh; +} +</style> +><input> +<dialog open=""> diff --git a/layout/painting/crashtests/1468124-1.html b/layout/painting/crashtests/1468124-1.html new file mode 100644 index 0000000000..9acf1427db --- /dev/null +++ b/layout/painting/crashtests/1468124-1.html @@ -0,0 +1,27 @@ +<html class="reftest-wait"> +<style> +:not(feFuncB) { + position: fixed; +} +a:last-child { + -webkit-transform-style: preserve-3d; +} +* { + -webkit-backface-visibility: hidden; +</style> +<script> +window.requestIdleCallback(function() { + document.documentElement.getBoundingClientRect(); +}); +function go() { + var c = document.createElement("a") + c.text = "-"; + try { c.replaceChild(b, c.childNodes[0]); } catch(e) { } + try { document.body.appendChild(c); } catch(e) { } + document.documentElement.className = ""; +} +</script> +<body onload=go()> +<d id="b">| +<audio controls=""> +</html> diff --git a/layout/painting/crashtests/1469472.html b/layout/painting/crashtests/1469472.html new file mode 100644 index 0000000000..f53d027704 --- /dev/null +++ b/layout/painting/crashtests/1469472.html @@ -0,0 +1,7 @@ +<style> +:not(polygon) { +background-image: url(#x); +background-blend-mode: hue, normal; +</style> +<table> +<th> diff --git a/layout/painting/crashtests/1477831-1.html b/layout/painting/crashtests/1477831-1.html new file mode 100644 index 0000000000..d6483bde02 --- /dev/null +++ b/layout/painting/crashtests/1477831-1.html @@ -0,0 +1,11 @@ +<style> +* { + margin-left: 1vw; + columns: 2; + opacity: 0.2; + -webkit-transform: rotate(0deg); +} +#a { float: left; } +</style> +<content id="a"> +<dd>A</dd> diff --git a/layout/painting/crashtests/1504033.html b/layout/painting/crashtests/1504033.html new file mode 100644 index 0000000000..9aeb7973be --- /dev/null +++ b/layout/painting/crashtests/1504033.html @@ -0,0 +1,13 @@ +<style> +* { -webkit-transform-style: preserve-3d } +</style> +<script> +function go() { + a.append("x"); +} +</script> +<body onload=go()> +<svg overflow="auto"> +<use xlink:href="#b" style="-webkit-transform-style: flat"/> +<use id="b" xlink:href="#a"> +<text id="a"> diff --git a/layout/painting/crashtests/1514544-1.html b/layout/painting/crashtests/1514544-1.html new file mode 100644 index 0000000000..8e9efdc3c4 --- /dev/null +++ b/layout/painting/crashtests/1514544-1.html @@ -0,0 +1,15 @@ +<html class="reftest-wait"> +<script> +setTimeout(function() { + a.appendChild(b); + document.documentElement.className = ""; +}, 100) +</script> +<style> +:root { opacity: 0 } +</style> +A +<textarea id="a" hidden=""></textarea> +<object id="b" > +A +</html> diff --git a/layout/painting/crashtests/1547420-1.html b/layout/painting/crashtests/1547420-1.html new file mode 100644 index 0000000000..ce54d67d09 --- /dev/null +++ b/layout/painting/crashtests/1547420-1.html @@ -0,0 +1,20 @@ +<script></script> +<style> +* { + text-align-last: right; + min-height: max-content; + min-width: 1vmin; + writing-mode: vertical-rl; +} +</style> +<q style="writing-mode: lr"> +<marquee></marquee> +<style></style> +</q> +<dl style="-webkit-transform: skew(0deg); mso-ignore: colspan"> +<dd> +<table> +<dt style="margin-left: 67%; scale: 7 46 0.006057077979"> +</dt> +<marquee bgcolor="-moz-mac-accentdarkestshadow"> +<button autofocus="autofocus"> diff --git a/layout/painting/crashtests/1549909.html b/layout/painting/crashtests/1549909.html new file mode 100644 index 0000000000..0542ee91a8 --- /dev/null +++ b/layout/painting/crashtests/1549909.html @@ -0,0 +1,9 @@ +<style> +* { + -webkit-column-break-after: always; + float: left; + column-width: 0px; +} +</style> +} +<video controls="controls"> diff --git a/layout/painting/crashtests/1551389-1.html b/layout/painting/crashtests/1551389-1.html new file mode 100644 index 0000000000..4ee12c1ce9 --- /dev/null +++ b/layout/painting/crashtests/1551389-1.html @@ -0,0 +1,6 @@ +<style> +dl::first-letter { float: right } +* { -webkit-box-shadow: -moz-cellhighlighttext 0px 34px 1px } +</style> +<s dir="RTL"> +<dl style="break-inside: avoid">AA</iframe> diff --git a/layout/painting/crashtests/1555819-1.html b/layout/painting/crashtests/1555819-1.html new file mode 100644 index 0000000000..0327e3690f --- /dev/null +++ b/layout/painting/crashtests/1555819-1.html @@ -0,0 +1,12 @@ +<style> +body { + width: 1px; + height: 5vmax; + -webkit-filter: brightness(1); +} +* { + grid-template-areas: ''; + columns: 1px; +} +</style> +<keygen autofocus="">aaaa diff --git a/layout/painting/crashtests/1574392.html b/layout/painting/crashtests/1574392.html new file mode 100644 index 0000000000..2e8c4d15aa --- /dev/null +++ b/layout/painting/crashtests/1574392.html @@ -0,0 +1 @@ +<u>🏴</u> diff --git a/layout/painting/crashtests/1589800-1.html b/layout/painting/crashtests/1589800-1.html new file mode 100644 index 0000000000..8af28028a0 --- /dev/null +++ b/layout/painting/crashtests/1589800-1.html @@ -0,0 +1,47 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta http-equiv="content-type" content="text/html; charset=utf-8"> + <style> + #parent { + transform: rotateZ(1deg); + position: absolute; + opacity: 0.5; + overflow-x: hidden; + } + + #child { + width: 10px; + height: 10px; + } + + .blend { + mix-blend-mode: color-burn; + } + </style> +</head> + +<body> + <div id="parent"> + <div id="child">a</div> + </div> + <div> + <div id="blend">a</div> + </div> + <script type="text/javascript"> + function modify() { + var e = document.getElementById("child"); + e.style.backgroundColor = "red"; + setTimeout(addBlend, 0); + } + + function addBlend() { + var e = document.getElementById("blend"); + e.classList.add("blend"); + } + + // setTimeout(modify, 3000); + window.addEventListener("MozAfterPaint", modify); + </script> +</body> +</html> diff --git a/layout/painting/crashtests/crashtests.list b/layout/painting/crashtests/crashtests.list new file mode 100644 index 0000000000..aea54e7537 --- /dev/null +++ b/layout/painting/crashtests/crashtests.list @@ -0,0 +1,26 @@ +load 1402183-1.html +load 1407470-1.html +load 1413073-1.html +load 1413073-2.html +load 1405881-1.html +load 1418177-1.html +load 1418722-1.html +load 1419917.html +load 1425271-1.html +load 1428906-1.html +load 1430589-1.html +load 1454105-1.html +load 1455944-1.html +load 1458145.html +load 1465305-1.html +load 1468124-1.html +load 1469472.html +load 1477831-1.html +load 1504033.html +load 1514544-1.html +asserts(0-1) load 1547420-1.html +load 1549909.html +asserts(6) load 1551389-1.html # bug 847368 +asserts(0-2) load 1555819-1.html +load 1574392.html +load 1589800-1.html |