diff options
| author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-19 00:47:55 +0000 |
|---|---|---|
| committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-19 00:47:55 +0000 |
| commit | 26a029d407be480d791972afb5975cf62c9360a6 (patch) | |
| tree | f435a8308119effd964b339f76abb83a57c29483 /dom/base/crashtests | |
| parent | Initial commit. (diff) | |
| download | firefox-26a029d407be480d791972afb5975cf62c9360a6.tar.xz firefox-26a029d407be480d791972afb5975cf62c9360a6.zip | |
Adding upstream version 124.0.1.upstream/124.0.1
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'dom/base/crashtests')
297 files changed, 5335 insertions, 0 deletions
diff --git a/dom/base/crashtests/1024428-1.html b/dom/base/crashtests/1024428-1.html new file mode 100644 index 0000000000..075077591c --- /dev/null +++ b/dom/base/crashtests/1024428-1.html @@ -0,0 +1,11 @@ +<!DOCTYPE html> +<html> +<head> +</head> +<body> +<div id="host"></div> +<script> + host.attachShadow({ mode: "open" }).innerHTML = '<input type="range" />'; +</script> +</body> +</html> diff --git a/dom/base/crashtests/1027461-1.html b/dom/base/crashtests/1027461-1.html new file mode 100644 index 0000000000..849a66c164 --- /dev/null +++ b/dom/base/crashtests/1027461-1.html @@ -0,0 +1,9 @@ +<!DOCTYPE html> +<html> + <head> + <meta charset="UTF-8"> + <link rel="import" href="1027461-inner.xhtml"> + </head> + <body> + </body> +</html> diff --git a/dom/base/crashtests/1027461-inner.xhtml b/dom/base/crashtests/1027461-inner.xhtml new file mode 100644 index 0000000000..84ee2d222a --- /dev/null +++ b/dom/base/crashtests/1027461-inner.xhtml @@ -0,0 +1,2 @@ +<?xml?> +<empty-xul-file /> diff --git a/dom/base/crashtests/1029710.html b/dom/base/crashtests/1029710.html new file mode 100644 index 0000000000..bb78b561e4 --- /dev/null +++ b/dom/base/crashtests/1029710.html @@ -0,0 +1,11 @@ +<!DOCTYPE html> +<html> +<body> +<script> + var x = document.createElement('span'); + x.attachShadow({ mode: "open" }); + x.id = 'a'; +</script> +</body> +</html> + diff --git a/dom/base/crashtests/1154598.xhtml b/dom/base/crashtests/1154598.xhtml new file mode 100644 index 0000000000..64d5506540 --- /dev/null +++ b/dom/base/crashtests/1154598.xhtml @@ -0,0 +1,9 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<body><body> +<script> +s = document.createElement('script'); +s.src=""; +document.body.appendChild(s); +</script> +</body> +</html> diff --git a/dom/base/crashtests/1157995.html b/dom/base/crashtests/1157995.html new file mode 100644 index 0000000000..5d822c0a68 --- /dev/null +++ b/dom/base/crashtests/1157995.html @@ -0,0 +1,9 @@ +<!DOCTYPE html> +<html> +<body> + <script> + // This should not leak. + var a = navigator; + navigator.mediaDevices._ = null; + </script> +</body> diff --git a/dom/base/crashtests/1158412.html b/dom/base/crashtests/1158412.html new file mode 100644 index 0000000000..e62fce1ab9 --- /dev/null +++ b/dom/base/crashtests/1158412.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> + +function boom() +{ + document.styleSheetSets.expando = null; + var otherDoc = document.implementation.createDocument("", "", null); + var otherSpan = otherDoc.createElementNS("http://www.w3.org/1999/xhtml", "span"); + + var img = document.createElementNS("http://www.w3.org/1999/xhtml", "img"); + img.srcset = "data:,a 1w, data:,b 1w"; + img.sizes = "1px"; + otherSpan.appendChild(img); +} + +</script> +</head> +<body onload="boom();"></body> +</html>
\ No newline at end of file diff --git a/dom/base/crashtests/116848-1.html b/dom/base/crashtests/116848-1.html new file mode 100644 index 0000000000..785d97fe64 --- /dev/null +++ b/dom/base/crashtests/116848-1.html @@ -0,0 +1,30 @@ +<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+<html>
+<head>
+ <title>Test case boiled down from www.sjetmarka.no</title>
+</head>
+<body>
+ <table>
+ <tr>
+ <td>
+ <SCRIPT language="JavaScript1.2">
+ document.write('<div>')
+ </script>
+ Hei og velkommen til Mozilla
+ <head>
+ <script language="JavaScript1.2">
+ document.write('</div>')
+ </script>
+ </head>
+ </td>
+ </tr>
+ </table>
+ <table>
+ <tr>
+ <td>
+ God jul til alle
+ </td>
+ </tr>
+ </table>
+</body>
+</html>
diff --git a/dom/base/crashtests/1181619.html b/dom/base/crashtests/1181619.html new file mode 100644 index 0000000000..929207964d --- /dev/null +++ b/dom/base/crashtests/1181619.html @@ -0,0 +1,14 @@ +<!DOCTYPE html> +<body> + <script> + var obs = new MutationObserver(function() { + // Just need something here to assert exception is not pending. Any + // binding method will do. + console.log("hello"); + }); + obs.observe(document.body, { childList: true }); + </script> + <script> + noSuchMethodYo(); + </script> +</body> diff --git a/dom/base/crashtests/1228882.html b/dom/base/crashtests/1228882.html new file mode 100644 index 0000000000..42dc5a6570 --- /dev/null +++ b/dom/base/crashtests/1228882.html @@ -0,0 +1,6 @@ +<!DOCTYPE html> +<html> +<body onload="b.dir='auto'; a.dir='auto'; b.remove();"> +<bdi id="a"><span id="b">f</span>g</bdi> +</body> +</html> diff --git a/dom/base/crashtests/1230422.html b/dom/base/crashtests/1230422.html new file mode 100644 index 0000000000..fbaa63d385 --- /dev/null +++ b/dom/base/crashtests/1230422.html @@ -0,0 +1,28 @@ +<!DOCTYPE html> +<html> +<head> +</head> +<body> +<script> + +var a = new FileReader(); + +function f() { + a.removeEventListener("loadend", f); + g(); +} + +function g() { + a.readAsBinaryString(new Blob()); +} + +a.addEventListener("loadend", f); + +try { + g(); + g(); +} catch(e) {} + +</script> +</body> +</html> diff --git a/dom/base/crashtests/1251361.html b/dom/base/crashtests/1251361.html new file mode 100644 index 0000000000..57c76121f5 --- /dev/null +++ b/dom/base/crashtests/1251361.html @@ -0,0 +1,33 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> + +var frameRoot; + +function boom() +{ + var frameWin = f.contentWindow; + frameRoot = frameWin.document.documentElement; + frameWin.location.replace("data:text/html;charset=UTF-8,<body onload='parent.g();'>2"); +} + +function g() +{ + setTimeout(h, 0); +} + +function h() +{ + var newDoc = document.implementation.createDocument('', '', null); + newDoc.adoptNode(frameRoot); +} + +</script> +<body onload="boom();"> + +<iframe id="f" src="data:text/html;charset=UTF-8,<marquee>1"></iframe> + +</body> +</html> diff --git a/dom/base/crashtests/1281715.html b/dom/base/crashtests/1281715.html new file mode 100644 index 0000000000..17352a30bd --- /dev/null +++ b/dom/base/crashtests/1281715.html @@ -0,0 +1,24 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<style> +html { + color: orange; +} +</style> + +<script> +function boom() +{ + document.documentElement.offsetHeight; + document.getElementById("hostW").attachShadow({ mode: "open" }).innerHTML = '<z></z>'; + document.getElementsByTagName("style")[0].remove(); +} +</script> + +</head> + +<body onload="boom();"><div style="display: contents;" id="hostW"></div></body> + +</html> diff --git a/dom/base/crashtests/1291535-iframe.html b/dom/base/crashtests/1291535-iframe.html new file mode 100644 index 0000000000..60ba42891a --- /dev/null +++ b/dom/base/crashtests/1291535-iframe.html @@ -0,0 +1,4 @@ +<script> + import("data:text/javascript,0").catch(x => 0); + window.stop(); +</script> diff --git a/dom/base/crashtests/1291535.html b/dom/base/crashtests/1291535.html new file mode 100644 index 0000000000..d57b3d762a --- /dev/null +++ b/dom/base/crashtests/1291535.html @@ -0,0 +1 @@ +<iframe src="1291535-iframe.html"></iframe> diff --git a/dom/base/crashtests/1304437.html b/dom/base/crashtests/1304437.html new file mode 100644 index 0000000000..a4e9d5110c --- /dev/null +++ b/dom/base/crashtests/1304437.html @@ -0,0 +1,13 @@ +<!DOCTYPE html> +<html> +<script> +window.onload=function(){ + var e=document.createElement("q"); + document.documentElement.appendChild(e); + e.style="mask-image:url(data:image/gif;base64,R0lGODlhAQABAIABAP///wAAACwAAAAAAQABAAACAkQBADs=),url(data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==)"; + setTimeout(function(){ + e.style="mask-image:url(data:image/gif;base64,R0lGODlhAQABAIABAP///wAAACwAAAAAAQABAAACAkQBADs=)"; + },0); +}; +</script> +</html> diff --git a/dom/base/crashtests/1324209.html b/dom/base/crashtests/1324209.html new file mode 100644 index 0000000000..99628e38d3 --- /dev/null +++ b/dom/base/crashtests/1324209.html @@ -0,0 +1,27 @@ +<!DOCTYPE HTML> +<html> +<head> +<script type="application/javascript"> + +function crash() { + var target1 = document.getElementById("target1"); + var target2 = document.getElementById("target2"); + var observer1 = new IntersectionObserver(function (entries) { + console.log(entries); + observer1.disconnect(); + observer2.disconnect(); + }); + var observer2 = new IntersectionObserver(function (entries) { + console.log(entries); + }); + observer1.observe(target1); + observer2.observe(target2); +} + +</script> +</head> +<body onload="crash()"> + <div id="target1" style="background: red; width: 50px; height: 50px"></div> + <div id="target2" style="background: green; width: 50px; height: 50px"></div> +</body> +</html> diff --git a/dom/base/crashtests/1324500.html b/dom/base/crashtests/1324500.html new file mode 100644 index 0000000000..83072c9bd1 --- /dev/null +++ b/dom/base/crashtests/1324500.html @@ -0,0 +1,4 @@ +<script> +setTimeout(function(){document.getElementById('id0510').removeAttribute('max');}, 46); +</script> +<input id='id0510'type='range'max=765> diff --git a/dom/base/crashtests/1326194-1.html b/dom/base/crashtests/1326194-1.html new file mode 100644 index 0000000000..802ae7c385 --- /dev/null +++ b/dom/base/crashtests/1326194-1.html @@ -0,0 +1,20 @@ +<!DOCTYPE HTML> +<html> +<head> +<script type="application/javascript"> + +// Crashes if 'target' doesn't get properly unlinked in nsINode::LastRelease + +function crash() { + var target = document.getElementById('target'); + var io = new IntersectionObserver(function () { }, { }); + io.observe(target); + document.body.removeChild(target); +} + +</script> +</head> +<body onload="crash()"> + <div id="target" style="background: red; width: 50px; height: 50px"></div> +</body> +</html> diff --git a/dom/base/crashtests/1326194-2.html b/dom/base/crashtests/1326194-2.html new file mode 100644 index 0000000000..dbced2f8ff --- /dev/null +++ b/dom/base/crashtests/1326194-2.html @@ -0,0 +1,20 @@ +<!DOCTYPE HTML> +<html> +<head> +<script type="application/javascript"> + +// Crashes if 'target' doesn't get properly unlinked in FragmentOrElement::Unlink + +function crash() { + var target = document.createElement('div'); + // By setting a custom prop we create a cycle between JS and C++ that requires the CC to break. + target.foo = 'bar'; + var io = new IntersectionObserver(function () { }, { }); + io.observe(target); +} + +</script> +</head> +<body onload="crash()"> +</body> +</html> diff --git a/dom/base/crashtests/1332939.html b/dom/base/crashtests/1332939.html new file mode 100644 index 0000000000..3b253912d6 --- /dev/null +++ b/dom/base/crashtests/1332939.html @@ -0,0 +1,16 @@ +<!DOCTYPE HTML> +<html> +<head> +<script type="application/javascript"> + +var target = document.createElement("div"); +target.foo = 'bar'; +var observer = new IntersectionObserver(function () { }); +observer.observe(target); +observer.unobserve(target); +observer = null; +target = null; + +</script> +</head> +</html> diff --git a/dom/base/crashtests/1341693.html b/dom/base/crashtests/1341693.html new file mode 100644 index 0000000000..677305ba56 --- /dev/null +++ b/dom/base/crashtests/1341693.html @@ -0,0 +1,13 @@ +<!DOCTYPE html> +<html> +<body> +<script> + var o1 = document.documentElement; + var o2 = document.createElement("frame"); + document.documentElement.appendChild(o2); + var o3 = o2.contentWindow; + o1.parentNode.removeChild(o1); + o3.customElements; +</script> +</body> +</html> diff --git a/dom/base/crashtests/1352453.html b/dom/base/crashtests/1352453.html new file mode 100644 index 0000000000..3fc2933e91 --- /dev/null +++ b/dom/base/crashtests/1352453.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html> + <head> + <style> + tr { + font: medium / 1000 cursive; + } + + :only-of-type { + border-image: repeating-linear-gradient(45deg, blue, red) space 1% / 1pt auto; + } + </style> + <script> + o1 = document.createElement('tr'); + o2 = document.createElement('th'); + o3 = document.createElement('rt'); + document.documentElement.appendChild(o1); + o1.appendChild(o2); + o2.appendChild(o3); + </script> + </head> +</html> diff --git a/dom/base/crashtests/1353529-inner.html b/dom/base/crashtests/1353529-inner.html new file mode 100644 index 0000000000..2c10a1e3da --- /dev/null +++ b/dom/base/crashtests/1353529-inner.html @@ -0,0 +1,12 @@ +<!DOCTYPE html> +<html> +<body onload="boom()"> +<div id="target"></div> +<script> + function boom() { + var io = new IntersectionObserver(function () { }, { }); + io.observe(document.getElementById('target')); + } +</script> +</body> +</html> diff --git a/dom/base/crashtests/1353529.xhtml b/dom/base/crashtests/1353529.xhtml new file mode 100644 index 0000000000..65b55c7822 --- /dev/null +++ b/dom/base/crashtests/1353529.xhtml @@ -0,0 +1,8 @@ +<?xml version="1.0"?> +<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?> +<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" + xmlns:xhtml="http://www.w3.org/1999/xhtml"> +<xhtml:div> + <iframe src="1353529-inner.html"></iframe> +</xhtml:div> +</window> diff --git a/dom/base/crashtests/1368327-iframe.html b/dom/base/crashtests/1368327-iframe.html new file mode 100644 index 0000000000..dbbdd99f38 --- /dev/null +++ b/dom/base/crashtests/1368327-iframe.html @@ -0,0 +1,10 @@ +<!DOCTYPE html> +<html lang="en"> + <head> + <meta charset="utf-8"> + <title>iframe</title> + </head> + <body> + <p><h1>iframe</h1></p> + </body> +</html> diff --git a/dom/base/crashtests/1368327.html b/dom/base/crashtests/1368327.html new file mode 100644 index 0000000000..ab2755f644 --- /dev/null +++ b/dom/base/crashtests/1368327.html @@ -0,0 +1,24 @@ +<!DOCTYPE html> +<html class="reftest-wait"> + <head> + <meta charset="utf-8"> + <title>Test window.location</title> + <script type="application/javascript"> + function test() { + content = document.querySelector("#content"); + testFrame = document.querySelector("#testframe"); + frameWindow = testFrame.contentWindow; + testframe.remove(); + + // Shouldn't crash at this line. + content.textContent = "location=" + frameWindow.location; + + document.documentElement.className = ""; + } + </script> + </head> + <body> + <p id="content"></p> + <iframe id="testframe" src="1368327-iframe.html" onload="setTimeout(test, 0);"></iframe> + </body> +</html> diff --git a/dom/base/crashtests/1369363.xhtml b/dom/base/crashtests/1369363.xhtml new file mode 100644 index 0000000000..fd7ddf9f14 --- /dev/null +++ b/dom/base/crashtests/1369363.xhtml @@ -0,0 +1,16 @@ +<?xml version="1.0"?> +<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?> +<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" + xmlns:xhtml="http://www.w3.org/1999/xhtml"> +<xhtml:div id="root"> +<xhtml:div id="target"> +</xhtml:div> +</xhtml:div> +<script> +<![CDATA[ + var io = new IntersectionObserver(function () { + }, { root: document.getElementById('root') }); + io.observe(document.getElementById('target')); +]]> +</script> +</window> diff --git a/dom/base/crashtests/1370072.html b/dom/base/crashtests/1370072.html new file mode 100644 index 0000000000..baecc8f35a --- /dev/null +++ b/dom/base/crashtests/1370072.html @@ -0,0 +1,18 @@ +<script> +function start() { + o1=document.createElement('iframe'); + o1.addEventListener('load',fun0); + document.body.appendChild(o1); +} +function fun0() { + o5=o1.contentDocument; + o52=function() {let x=o5.querySelectorAll('*:not([id])');return x[x.length-1]}(); + o1.contentWindow.onresize=fun1; + o1.height='5px'; + o52.clientTop; +} +function fun1() { + document.documentElement.appendChild(o1); +} +</script> +<body onload="start()"></body> diff --git a/dom/base/crashtests/1370737.html b/dom/base/crashtests/1370737.html new file mode 100644 index 0000000000..0e0e1a0e0e --- /dev/null +++ b/dom/base/crashtests/1370737.html @@ -0,0 +1,41 @@ +<html class="reftest-wait"> +<script> +document.addEventListener("DOMContentLoaded", function(){ + let n=document.getElementById('a'); + n.parentNode.removeChild(n); + let o=document.getElementById('b'); + let p=document.getElementById('c'); + p.id=[o.id, o.id=p.id][0]; + let l=['d']; + let s=window.getSelection(); + for(let i=0; i<l.length; i++){ + let e=document.getElementById(l[i]); + let r=document.createRange(); + r.selectNode(e); + s.addRange(r); + } + n=document.getElementById('b'); + n.parentNode.removeChild(n); + window.getSelection().modify('extend','right','word'); + n.setAttribute('id','e'); + document.getElementById('f').appendChild(n); + l=['e']; + for(let i=0; i<l.length; i++){ + let e=document.getElementById(l[i]); + let r=document.createRange(); + r.selectNode(e); + s.addRange(r); + } + document.documentElement.removeAttribute("class"); +}); +</script> +<table> +<tbody hidden> +<th id='c'> +<i id='d'> +<bdo id='b'></bdo> +<td></td> +<tbody id='f'> +<td id='a' contenteditable='true'> +<td> +</html> diff --git a/dom/base/crashtests/1370968-inner.xhtml b/dom/base/crashtests/1370968-inner.xhtml new file mode 100644 index 0000000000..6d9d6aa882 --- /dev/null +++ b/dom/base/crashtests/1370968-inner.xhtml @@ -0,0 +1,6 @@ +<?xml version="1.0"?> +<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?> +<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" + xmlns:xhtml="http://www.w3.org/1999/xhtml"> +<xhtml:div id="target"></xhtml:div> +</window> diff --git a/dom/base/crashtests/1370968.html b/dom/base/crashtests/1370968.html new file mode 100644 index 0000000000..81973b413c --- /dev/null +++ b/dom/base/crashtests/1370968.html @@ -0,0 +1,14 @@ +<!DOCTYPE html> +<html> +<body> +<iframe id="iframe" src="1370968-inner.xhtml"></iframe> +<script> + var io = new IntersectionObserver(function () { + }, { }); + var iframe = document.getElementById('iframe'); + iframe.onload = function () { + io.observe(iframe.contentDocument.getElementById('target')); + }; +</script> +</body> +</html> diff --git a/dom/base/crashtests/1373750.html b/dom/base/crashtests/1373750.html new file mode 100644 index 0000000000..f9fdb2a9b2 --- /dev/null +++ b/dom/base/crashtests/1373750.html @@ -0,0 +1,14 @@ +<!DOCTYPE html> +<html> +<head> +<style> +div { + /* Add two mask layers and apply border-radius to the bottom-most layer. */ + mask: linear-gradient(red, blue) border-box no-clip, 6%; + border-style: solid; + border-top-left-radius: 24%; +} +</style> +</head> +<div></div> +</html> diff --git a/dom/base/crashtests/1377826.html b/dom/base/crashtests/1377826.html new file mode 100644 index 0000000000..7934771889 --- /dev/null +++ b/dom/base/crashtests/1377826.html @@ -0,0 +1,5 @@ +<li id='a' dir='auto'> +<select> +<option dir='rtl'> +ࣃ +</html> diff --git a/dom/base/crashtests/1383478.html b/dom/base/crashtests/1383478.html new file mode 100644 index 0000000000..ca90494b17 --- /dev/null +++ b/dom/base/crashtests/1383478.html @@ -0,0 +1,49 @@ +<!DOCTYPE html> +<html lang="en" dir="ltr"> + <head> + <meta charset="utf-8" /> + <title>This browser is crashing</title> + </head> + <body> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> +<Object class="crashDroid" /> + </body> +</html> diff --git a/dom/base/crashtests/1383780.html b/dom/base/crashtests/1383780.html new file mode 100644 index 0000000000..54738cc53f --- /dev/null +++ b/dom/base/crashtests/1383780.html @@ -0,0 +1,21 @@ +<html> + <head> + <script> + try { o1 = document.createElementNS('http://www.w3.org/2000/svg', 'use') } catch(e) { } + try { o2 = document.createElement('img') } catch(e) { } + try { o4 = document.createElement('area') } catch(e) { } + try { o5 = document.createElement('tr') } catch(e) { } + try { o6 = document.createRange(); } catch(e) { } + try { o7 = window.getSelection() } catch(e) { } + try { document.documentElement.appendChild(o1) } catch(e) { } + try { document.head.outerHTML = '<progress></progress>'; } catch(e) { } + try { o1.appendChild(o2); } catch(e) { } + try { o2.appendChild(o4) } catch(e) { } + try { o4.appendChild(o5); } catch(e) { } + try { document.designMode = 'on'; } catch(e) { } + try { o6.selectNode(o5); } catch(e) { } + try { o7.addRange(o6); } catch(e) { } + try { document.execCommand('justifyleft', false, null) } catch(e) { } + </script> + </head> +</html> diff --git a/dom/base/crashtests/1385272-1.html b/dom/base/crashtests/1385272-1.html new file mode 100644 index 0000000000..5bdd407998 --- /dev/null +++ b/dom/base/crashtests/1385272-1.html @@ -0,0 +1,29 @@ +<html> + <head> + <script> + try { o1 = document.createElement("tr") } catch(e) { } + try { o2 = document.createElement("td") } catch(e) { } + try { o3 = document.createElement("tr") } catch(e) { } + try { o4 = document.createElement("div") } catch(e) { } + try { o5 = document.createElement("input") } catch(e) { } + try { o6 = document.createElement('map') } catch(e) { } + try { o7 = document.createElement('select') } catch(e) { } + try { o8 = document.createElement("canvas") } catch(e) { } + try { o9 = document.createElement("area") } catch(e) { }; + try { o1.appendChild(o2) } catch(e) { } + try { document.documentElement.appendChild(o3) } catch(e) { } + try { document.documentElement.appendChild(o4) } catch(e) { } + try { document.documentElement.appendChild(o6) } catch(e) { } + try { o3.appendChild(o7) } catch(e) { } + try { o4.appendChild(o8) } catch(e) { } + try { o3.appendChild(o5); } catch(e) { } + try { o3.appendChild(o1); } catch(e) { } + try { o6.contentEditable = "true" } catch(e) { }; + try { o6.offsetHeight } catch(e) { }; + try { o4.appendChild(o9) } catch(e) { }; + try { o2.insertAdjacentHTML("beforeBegin", "<button id='id0'></button>\n"); } catch(e) { } + try { document.replaceChild(document.documentElement, document.documentElement); } catch(e) { } + try { document.execCommand("selectall",false,null) } catch(e) { } + </script> + </head> +</html> diff --git a/dom/base/crashtests/1393806.html b/dom/base/crashtests/1393806.html new file mode 100644 index 0000000000..4e859bf602 --- /dev/null +++ b/dom/base/crashtests/1393806.html @@ -0,0 +1,17 @@ +<html> + <head> + <script> + function fun_0() { + document.implementation.createDocument('', '', null).adoptNode(o2); + } + + o1 = document.createElement('map'); + o2 = document.createElement('iframe'); + document.documentElement.appendChild(o1); + document.documentElement.appendChild(o2); + o1.textContent = 'x'; + document.addEventListener('DOMNodeRemoved', fun_0, false); + o1.innerText = 'x'; + </script> + </head> +</html> diff --git a/dom/base/crashtests/1396466.html b/dom/base/crashtests/1396466.html new file mode 100644 index 0000000000..09f36fa0d4 --- /dev/null +++ b/dom/base/crashtests/1396466.html @@ -0,0 +1,20 @@ +<script> +function addNew(i,t){ + let n=document.createElement(t); + n.setAttribute('id', i); + document.getElementById('a').appendChild(n); +} +document.addEventListener("DOMContentLoaded", function(){ + addNew('b','multicol'); + addNew('c','marquee'); + addNew('d','spacer'); + document.getElementById('a').appendChild(document.createElement('iframe')); + document.getElementById('b').focus(); + window.frames[0].document.body.appendChild(document.getElementById('c')); + let o=window.frames[0].document.body.childNodes[0]; + document.getElementById('d').appendChild(o.parentNode.removeChild(o)); + try{window.find('x')}catch(e){} + window.frames[0].document.body.appendChild(document.getElementById('c')); +}); +</script> +<body id='a'></body> diff --git a/dom/base/crashtests/1397795.html b/dom/base/crashtests/1397795.html new file mode 100644 index 0000000000..4ba525a9c1 --- /dev/null +++ b/dom/base/crashtests/1397795.html @@ -0,0 +1,23 @@ +<html> + <style> + html { + writing-mode: vertical-rl; + } + body { + column-count: 2; + } + svg { + -moz-box-shadow: green 2px 2px 8px; + box-shadow: green 2px 2px 8px; + -moz-appearance: button; + appearance: button; + } + + </style> + <body> + <div id='id0'> + <svg width='800' filter='url(#id0')></svg> + </div> + </body> +</html> + diff --git a/dom/base/crashtests/1400701.html b/dom/base/crashtests/1400701.html new file mode 100644 index 0000000000..fe1eef5d50 --- /dev/null +++ b/dom/base/crashtests/1400701.html @@ -0,0 +1,15 @@ +<html> +<script> +window.onload=function(){ + document.getElementById('b').textContent='Or'; + document.getElementById('a').insertBefore(document.getElementById('c'), undefined); + document.getElementById('b').dir='ltr'; + let o=document.getElementById('b'); + o.parentNode.replaceChild(document.createElement('code'), o); +} +</script> +<body dir='auto' id='a'> +<bdi id='b' dir='auto'> +</bdi> +<q id='c'> +</html>
\ No newline at end of file diff --git a/dom/base/crashtests/1403377.html b/dom/base/crashtests/1403377.html new file mode 100644 index 0000000000..2afbb66f1f --- /dev/null +++ b/dom/base/crashtests/1403377.html @@ -0,0 +1,18 @@ +<script> +function fzfn(e){ + let nc=window.frames[0].document.body.childElementCount; + let o=window.frames[0].document.body.childNodes[1%nc]; + document.getElementById('b').appendChild(o.parentNode.removeChild(o)); +} +window.onload=function(){ + document.body.onerror=fzfn; + document.getElementById('c').addEventListener('DOMNodeRemoved', fzfn, true); + document.getElementById('c').attributes[0].name=='id'; + window.frames[0].document.body.appendChild(document.getElementById('c')); + document.getElementById('a').innerHTML=document.createElement('multicol').outerHTML; +} +</script> +<iframe></iframe> +<script id='a'></script> +<script id='b'></script> +<script id='c'></script> diff --git a/dom/base/crashtests/1405771.html b/dom/base/crashtests/1405771.html new file mode 100644 index 0000000000..120fcaf294 --- /dev/null +++ b/dom/base/crashtests/1405771.html @@ -0,0 +1,20 @@ +<html> +<head> +<script></script> +<!-- a --> +<script> +window.onload=function(){ + let s=window.getSelection(); + let r=document.createRange(); + r.selectNode(document.getElementById('b')); + s.addRange(r); + try{window.getSelection().modify('extend','forward','word')}catch(e){} + let o=document.getElementById('a'); + o.parentNode.replaceChild(document.createElement('col'), o); +} +</script> +> +<template id='a' contenteditable='true'></template> +<header id='b'></header> +<!-- a --> +</html>
\ No newline at end of file diff --git a/dom/base/crashtests/1406109-1.html b/dom/base/crashtests/1406109-1.html new file mode 100644 index 0000000000..4ec653dd6f --- /dev/null +++ b/dom/base/crashtests/1406109-1.html @@ -0,0 +1,10 @@ +<html> +<head> +<script> +function jsfuzzer() { + try { a.matches("1"); } catch(e) { } + try { document.createElement("p").closest("1"); } catch(e) { } +} +</script> +<body onload=jsfuzzer()> +<feBlend id="a" /> diff --git a/dom/base/crashtests/1411473.html b/dom/base/crashtests/1411473.html new file mode 100644 index 0000000000..93e42bd8a2 --- /dev/null +++ b/dom/base/crashtests/1411473.html @@ -0,0 +1,12 @@ +<html> + <head class="reftest-wait"> + <script> + var img = new Image(-256, 1024); + img.src = 'data:;base64,R0lGODlhAQABAAAAACwAAAAAAQABAAA'; + img.onload = function () { + img.crossOrigin ="Anonymous"; + document.implementation.createDocument('', '', null).adoptNode(img); + }; + </script> + </head> +</html> diff --git a/dom/base/crashtests/1413815.html b/dom/base/crashtests/1413815.html new file mode 100644 index 0000000000..309e54d082 --- /dev/null +++ b/dom/base/crashtests/1413815.html @@ -0,0 +1,20 @@ +<!DOCTYPE html> +<html> +<body> +<script type="text/javascript"> +class XFoo extends HTMLElement { + constructor() { + super(); + } + + static get observedAttributes() { + return [3.76277868767527e-310, Symbol("Ashitaka"), {}]; + } + + attributeChangedCallback(aName, aOldValue, aNewValue) { + } +} + +customElements.define('x-foo', XFoo); +</script> +</html> diff --git a/dom/base/crashtests/1419799.html b/dom/base/crashtests/1419799.html new file mode 100644 index 0000000000..b6d34a1a97 --- /dev/null +++ b/dom/base/crashtests/1419799.html @@ -0,0 +1,17 @@ +<html> + <head> + <script> + try { o1 = document.createElement('textarea') } catch(e) { } + try { o2 = document.createElement('div') } catch(e) { } + try { o3 = document.createElement('map') } catch(e) { } + try { document.documentElement.appendChild(o2) } catch(e) { } + try { o2.appendChild(o1) } catch(e) { } + try { document.documentElement.getClientRects() } catch(e) { } + try { o4 = o2.attachShadow({ mode: "open" }); } catch(e) { } + try { o1.appendChild(o3) } catch(e) { } + try { o5 = o3.parentElement } catch(e) { } + try { o3.outerHTML = "\n" } catch(e) { } + try { o4.prepend("", o5, "") } catch(e) { } + </script> + </head> +</html> diff --git a/dom/base/crashtests/1419902.html b/dom/base/crashtests/1419902.html new file mode 100644 index 0000000000..b0742b5be0 --- /dev/null +++ b/dom/base/crashtests/1419902.html @@ -0,0 +1,23 @@ +<html> + <head> + <script> + var winsToClose = [] + onbeforeunload = function() { + for (let win of winsToClose) { + if (win) { + win.close(); + } + } + }; + for (let i = 0; i < 38; i++) { + customElements.define("custom-element_0", class extends HTMLElement { + constructor() { + try { o1 = document.createElement("custom-element_0") } catch (e) {} + try { winsToClose.push(window.open("javascript:'<html><body>dummy</body></html>';")); } catch (e) {} + } + }) + try { o3 = document.createElement("custom-element_0") } catch (e) {} + } + </script> + </head> +</html> diff --git a/dom/base/crashtests/1422883.html b/dom/base/crashtests/1422883.html new file mode 100644 index 0000000000..f074592e91 --- /dev/null +++ b/dom/base/crashtests/1422883.html @@ -0,0 +1,10 @@ +<style> +:after{-webkit-mask:url(#);content:counter(a)} +</style> +<script> +function go(){ + a.attachShadow({mode:"closed"}) +} +</script> +<body onload=go()> +<h2 id="a"> diff --git a/dom/base/crashtests/1428053.html b/dom/base/crashtests/1428053.html new file mode 100644 index 0000000000..d40496da6d --- /dev/null +++ b/dom/base/crashtests/1428053.html @@ -0,0 +1,23 @@ +<script> + try { o1 = document.createElement("h1") } catch (e) {} + try { o2 = document.createElement("slot") } catch (e) {} + try { o3 = document.createElement("o") } catch (e) {} + try { document.documentElement.appendChild(o1) } catch (e) {} + try { document.documentElement.appendChild(o3) } catch (e) {} + try { o4 = o1.attachShadow({mode: "open"}) } catch (e) {} + try { o5 = new Range() } catch (e) {} + try { o6 = new MutationObserver(function(arg_0, arg_1) { + try { o4.append("", o2, "") } catch (e) {}; + }) } catch (e) {} + try { o5.selectNode(o3); } catch (e) {} + try { customElements.define("custom-element_0", class extends HTMLElement { + connectedCallback() { + try { this.offsetHeight } catch (e) {} + } + }) } catch (e) {} + try { o8 = document.createElement("custom-element_0") } catch (e) {} + try { document.documentElement.appendChild(o8) } catch (e) {} + try { o6.observe(document, { "childList": [""] }); } catch (e) {} + try { document.replaceChild(o5.endContainer, document.documentElement); } catch (e) {} + try { o1.insertAdjacentHTML("afterBegin", "<</#"); } catch (e) {} +</script> diff --git a/dom/base/crashtests/1441029.html b/dom/base/crashtests/1441029.html new file mode 100644 index 0000000000..1d222fdd29 --- /dev/null +++ b/dom/base/crashtests/1441029.html @@ -0,0 +1 @@ +<div is="div"> diff --git a/dom/base/crashtests/1445670.html b/dom/base/crashtests/1445670.html new file mode 100644 index 0000000000..8afbcfbea2 --- /dev/null +++ b/dom/base/crashtests/1445670.html @@ -0,0 +1,20 @@ +<html> + <head> + <script> + function go () { + try { o1 = document.getElementById('x') } catch(e) { } + try { o1.src = '=' } catch(e) { } + try { o2 = document.cloneNode(false) } catch(e) { } + try { o3 = new XMLHttpRequest({mozAnon: true}) } catch(e) { } + try { o3.open('GET', 1, false) } catch(e) { } + try { o3.send() } catch(e) { } + try { o2.prepend('', o1, '', o2) } catch(e) { } + } + document.addEventListener('DOMContentLoaded', go) + </script> + </head> + <body> + <picture> + <img id='x' src='data:image/png;base64,R0lGODlhAQABAAD/ACH/C05FVFNDQVBFMi4wAwEAAAAsAAAAAEAAQAAAgA'/> + </body> +</html>
\ No newline at end of file diff --git a/dom/base/crashtests/1449601.html b/dom/base/crashtests/1449601.html new file mode 100644 index 0000000000..7dcd22706d --- /dev/null +++ b/dom/base/crashtests/1449601.html @@ -0,0 +1,16 @@ +<!DOCTYPE html> +<html> + <body> + <script> + var blob = new Blob(["foo"], { type: "text/plain" }); + var url = URL.createObjectURL(blob); + var ifr = document.createElement("iframe"); + ifr.src = url; + document.body.appendChild(ifr); + + onload = function() { + try { window.find('foo',false,true,true,true,true) } catch(e) { } + } + </script> + </body> +</html> diff --git a/dom/base/crashtests/1458016.html b/dom/base/crashtests/1458016.html new file mode 100644 index 0000000000..1876938136 --- /dev/null +++ b/dom/base/crashtests/1458016.html @@ -0,0 +1,12 @@ +<script> +function go() { + b.appendChild(document.body.firstChild); + var c = document.getSelection(); + c.setPosition(a,1); + c.containsNode(document.body.firstChild); +} +</script> +<body onload=go()> +<!--a--> +<time id="a" additive="replace"> +<option id="b"> diff --git a/dom/base/crashtests/1459688.html b/dom/base/crashtests/1459688.html new file mode 100644 index 0000000000..63bd08b5c6 --- /dev/null +++ b/dom/base/crashtests/1459688.html @@ -0,0 +1,6 @@ +<!doctype html> +<div id="host"></div> +<script> + host.attachShadow({ mode: "open" }).innerHTML = `<style></style>`; + host.shadowRoot.styleSheets[0].foobie = host.shadowRoot; +</script> diff --git a/dom/base/crashtests/1460794.html b/dom/base/crashtests/1460794.html new file mode 100644 index 0000000000..200e5801cf --- /dev/null +++ b/dom/base/crashtests/1460794.html @@ -0,0 +1,19 @@ +<script> +function go() { + b.addEventListener("DOMAttrModified", eh2); + e.setAttribute("lang", "en-us"); +} +function eh1() { + a.getSVGDocument().adoptNode(c); +} +function eh2() { + d.addEventListener("DOMNodeRemoved", eh1); + d.innerHTML = undefined; +} +</script> +<body onload=go()> +<iframe id="a"></iframe> +<a id="c"/> +<g id="d"> +<mask id="b"/> +<font-face-format id="e"> diff --git a/dom/base/crashtests/1462548.html b/dom/base/crashtests/1462548.html new file mode 100644 index 0000000000..24eace10d1 --- /dev/null +++ b/dom/base/crashtests/1462548.html @@ -0,0 +1,13 @@ +<script> +window.requestIdleCallback(function(){SpecialPowers.forceCC()}); +var limit = 0; +function go() { +limit++; if(limit > 2) { return; } + var b = document.createElement("blockquote").attachShadow({mode: "open"}); + b.innerHTML = a.innerHTML; +} +</script> +<data id="a"> +<audio> +<source onerror="go()"> +<link> diff --git a/dom/base/crashtests/149320-1.html b/dom/base/crashtests/149320-1.html new file mode 100644 index 0000000000..d09b2c5ada --- /dev/null +++ b/dom/base/crashtests/149320-1.html @@ -0,0 +1,16 @@ +<html>
+<head>
+</head>
+<body>
+<div>Selection is HERE only</div>
+<script type="text/javascript">
+ selectedNode = document.getElementsByTagName("div").item(0);
+ testRange = document.createRange();
+
+ testRange.setStart(selectedNode, 13);
+ testRange.setEnd(selectedNode, 17);
+
+ document.body.appendChild(document.createTextNode("Text of Range: "+testRange));
+</script>
+</body>
+</html>
\ No newline at end of file diff --git a/dom/base/crashtests/1505811.html b/dom/base/crashtests/1505811.html new file mode 100644 index 0000000000..10be85c6dd --- /dev/null +++ b/dom/base/crashtests/1505811.html @@ -0,0 +1,24 @@ +<html> + +<head> + <script> + function start() { + window.CustomElement0 = class extends HTMLElement { + constructor() { + super() + } + connectedCallback() { + this.before('', custom) + this.outerHTML = '<input pattern=""value=ð>' + } + } + customElements.define('custom-element-0', CustomElement0) + custom = document.createElementNS('http://www.w3.org/1999/xhtml', 'custom-element-0') + document.documentElement.appendChild(custom) + } + + document.addEventListener('DOMContentLoaded', start) + </script> +</head> + +</html>
\ No newline at end of file diff --git a/dom/base/crashtests/1505875.html b/dom/base/crashtests/1505875.html new file mode 100644 index 0000000000..24a7d82a09 --- /dev/null +++ b/dom/base/crashtests/1505875.html @@ -0,0 +1,10 @@ +<script>
+function go() {
+ var r = document.getSelection().getRangeAt(0).cloneRange();
+ a.type = "";
+ r.insertNode(b);
+}
+</script>
+<body onload=go()>
+<input id="a" autofocus type="date">
+<summary id="b">x</summary>
diff --git a/dom/base/crashtests/1508845.html b/dom/base/crashtests/1508845.html new file mode 100644 index 0000000000..470b19b674 --- /dev/null +++ b/dom/base/crashtests/1508845.html @@ -0,0 +1,17 @@ +<script> +window.onload=function(){ + let bigShadowTree = `<div>`; + for (let i = 0; i < 10; ++i) + bigShadowTree = bigShadowTree + bigShadowTree; + b.attachShadow({ mode: 'open' }).innerHTML = bigShadowTree; + // Create wrappers for all those elements. + [...b.shadowRoot.querySelectorAll('*')].forEach(() => {}); + document.documentElement.addEventListener('DOMNodeRemoved', function(){ + window.frames[0].document.body.appendChild(b) + }) + window.frames[0].document.body.appendChild(a) +} +</script> +<mark id='a'> +<iframe></iframe> +<div id='b'> diff --git a/dom/base/crashtests/1516289.html b/dom/base/crashtests/1516289.html new file mode 100644 index 0000000000..f6d4255213 --- /dev/null +++ b/dom/base/crashtests/1516289.html @@ -0,0 +1,14 @@ +<script> +function eh1() { + a.remove() + window.event.composedPath() +} +function eh2() { + b.addEventListener("DOMNodeInserted", eh1) + c.insertAdjacentElement("afterBegin", document.createElement("s")) +} +</script> +<image srcset="A" onerror="eh2()"></image> +<marquee id="a"> +<time id="b"> +<dialog id="c">AA</dialog> diff --git a/dom/base/crashtests/1516560.html b/dom/base/crashtests/1516560.html new file mode 100644 index 0000000000..61c57e63d6 --- /dev/null +++ b/dom/base/crashtests/1516560.html @@ -0,0 +1,3 @@ +<script> + for (var i = 0; i < 10000; ++i) location.noSuchProp; +</script> diff --git a/dom/base/crashtests/1517025.html b/dom/base/crashtests/1517025.html new file mode 100644 index 0000000000..795af0a3a9 --- /dev/null +++ b/dom/base/crashtests/1517025.html @@ -0,0 +1,5 @@ +<html> + <body> + <iframe src="/\b%9ª"> + </body> +</html> diff --git a/dom/base/crashtests/1528675.html b/dom/base/crashtests/1528675.html new file mode 100644 index 0000000000..122935c1f5 --- /dev/null +++ b/dom/base/crashtests/1528675.html @@ -0,0 +1,28 @@ +<script> +function start() { + o14=window.document; + o432=document.createElement('audio'); + o433=document.createElement('track'); + o432.appendChild(o433); + o493=o432.textTracks; + o14.write('<html></html>'); + o757=document.createElement('iframe'); + o757.addEventListener('load', fun0, false); + document.documentElement.appendChild(o757); + o432.controls^=1; +} +function fun0(e) { + o1062=e.target; + o1063=o1062.contentWindow; + o1064=o1063.document; + document.documentElement.appendChild(o432); + setTimeout(fun1,240); +} +function fun1() { + o433.parentNode.removeChild(o433); + document.replaceChild(o1064.documentElement,document.documentElement); + SpecialPowers.forceGC(); + SpecialPowers.forceCC(); +} +</script> +<body onload="start()"></body> diff --git a/dom/base/crashtests/1529203-1.html b/dom/base/crashtests/1529203-1.html new file mode 100644 index 0000000000..322a98f628 --- /dev/null +++ b/dom/base/crashtests/1529203-1.html @@ -0,0 +1,17 @@ +<!DOCTYPE HTML> +<html class="reftest-wait"> +<iframe></iframe> +<script> + function doIt() { + var doc = document.querySelector("iframe").contentDocument; + doc.open(); + doc.write('<script>import("data:text/javascript,")</' + 'script>'); + doc.close(); + } + doIt(); + setTimeout(() => { + doIt(); + document.documentElement.removeAttribute("class"); + }, 100); +</script> +</html> diff --git a/dom/base/crashtests/1529203-2.html b/dom/base/crashtests/1529203-2.html new file mode 100644 index 0000000000..edf071488a --- /dev/null +++ b/dom/base/crashtests/1529203-2.html @@ -0,0 +1,21 @@ +<!DOCTYPE HTML> +<html class="reftest-wait"> +<script> + var win = null; + function doIt() { + if (win === null) { + win = window.open(); + } + var doc = win.document; + doc.open(); + doc.write('<script>import("data:text/javascript,")</' + 'script>'); + doc.close(); + } + doIt(); + setTimeout(() => { + doIt(); + win.close(); + document.documentElement.removeAttribute("class"); + }, 100); +</script> +</html> diff --git a/dom/base/crashtests/1529203-3.html b/dom/base/crashtests/1529203-3.html new file mode 100644 index 0000000000..ce8c2a5633 --- /dev/null +++ b/dom/base/crashtests/1529203-3.html @@ -0,0 +1,21 @@ +<!DOCTYPE HTML> +<html class="reftest-wait"> +<script> + var win; + function doIt() { + if (!win) { + win = window.open(); + } + var doc = win.document; + doc.open(); + doc.write('<script type="module" src="./module-with-syntax-error.js"></' + 'script>'); + doc.close(); + } + doIt() + setTimeout(() => { + doIt(); + win.close(); + document.documentElement.removeAttribute("class"); + }, 100); +</script> +</html> diff --git a/dom/base/crashtests/1555786.html b/dom/base/crashtests/1555786.html new file mode 100644 index 0000000000..97740ad795 --- /dev/null +++ b/dom/base/crashtests/1555786.html @@ -0,0 +1,23 @@ +<html> +<head> + <script> + function start() { + const xhr = new XMLHttpRequest(); + const observer = new ResizeObserver(entries => { + xhr.open('GET', '', false); + xhr.send(); + typeof entries[0].borderBoxSize; + typeof entries[0].contentRect; + typeof entries[0].borderBoxSize; + }) + observer.observe(document.getElementById('list'), {}); + window.close(); + } + + document.addEventListener('DOMContentLoaded', start); + </script> +</head> +<body> + <li class="" id="list"> +</body> +</html> diff --git a/dom/base/crashtests/1566310.html b/dom/base/crashtests/1566310.html new file mode 100644 index 0000000000..f00b168b70 --- /dev/null +++ b/dom/base/crashtests/1566310.html @@ -0,0 +1,24 @@ +<!doctype html> +<html> +<head> +<script type="text/javascript"> +function noop() {} +function crash() { + let div = document.querySelector("div"); + let ifr = document.querySelector("iframe"); + + // We need a reference to the iframe's window from *before* it gets detached. + let win = ifr.contentWindow; + + div.appendChild(ifr); + + win.addEventListener("beforeunload", noop); + win.removeEventListener("beforeunload", noop); +} +</script> +</head> +<body onload="crash()"> + <div></div> + <iframe></iframe> +</body> +</html> diff --git a/dom/base/crashtests/1577191.html b/dom/base/crashtests/1577191.html new file mode 100644 index 0000000000..603157dd52 --- /dev/null +++ b/dom/base/crashtests/1577191.html @@ -0,0 +1,15 @@ +<!doctype html> +<script> + function start () { + const frame = document.createElement('frame') + document.documentElement.appendChild(frame) + const o1 = document.createElement('c') + o1.insertBefore(frame, o1.childNodes[0]) + SpecialPowers.gc(); + const xhr = new XMLHttpRequest() + xhr.open('P', '', false) + xhr.send() + } + + document.addEventListener('DOMContentLoaded', start) +</script> diff --git a/dom/base/crashtests/1588259.html b/dom/base/crashtests/1588259.html new file mode 100644 index 0000000000..6192b78ad1 --- /dev/null +++ b/dom/base/crashtests/1588259.html @@ -0,0 +1,21 @@ +<html class="reftest-wait"> +<script> +if (location.search == "?x=") { + setTimeout(() => window.close(), 1000); +} else { + document.fonts.onloadingdone = () => { + document.forms[1].submit(); + }; + window.onload = () => { + document.forms[0].submit(); + setTimeout(() => { + document.documentElement.removeAttribute("class"); + }, 1000); + }; +} +</script> +<body> +<form target="bug1588259"><input name="x"></form> +<form target="bug1588259"><input name="x"></form> +</body> +</html> diff --git a/dom/base/crashtests/1611853.html b/dom/base/crashtests/1611853.html new file mode 100644 index 0000000000..2d1a153d59 --- /dev/null +++ b/dom/base/crashtests/1611853.html @@ -0,0 +1,19 @@ +<html class="reftest-wait"> +<head> + <style> + * { + user-select: none; + } + </style> + <script> + function start () { + document.execCommand('selectAll', false); + document.documentElement.removeAttribute("class"); + } + </script> +</head> +<body onload="start()"> +<div contentEditable="true"></div> +</body> +</html> + diff --git a/dom/base/crashtests/1619322.html b/dom/base/crashtests/1619322.html new file mode 100644 index 0000000000..1e627a4bad --- /dev/null +++ b/dom/base/crashtests/1619322.html @@ -0,0 +1,17 @@ +<html class="reftest-wait"> + <iframe></iframe> + <script> + window.addEventListener('load', () => { + let doc = frames[0].document; + let count = 0; + let id = setInterval(function () { + if (!doc.documentElement) { + clearInterval(id); + document.documentElement.className = ""; + } + doc.documentElement.replaceWith(); + }, 312) + doc.addEventListener('DOMSubtreeModified', (e) => e.originalTarget.writeln(), false) + }) + </script> +</html> diff --git a/dom/base/crashtests/1623918.html b/dom/base/crashtests/1623918.html new file mode 100644 index 0000000000..0c991acbbc --- /dev/null +++ b/dom/base/crashtests/1623918.html @@ -0,0 +1,16 @@ +<html> +<head> + <script> + window.addEventListener('load', () => { + const anchor = document.getElementById('id_7') + anchor.contentEditable = 'true' + anchor.spellcheck = false + const input = document.createElementNS('http://www.w3.org/1999/xhtml', 'input') + anchor.appendChild(input) + const selection = self.getSelection() + selection.selectAllChildren(input) + }) + </script> +</head> +<a id='id_7'></a> +</html> diff --git a/dom/base/crashtests/1656925.html b/dom/base/crashtests/1656925.html new file mode 100644 index 0000000000..3ebd9b53cb --- /dev/null +++ b/dom/base/crashtests/1656925.html @@ -0,0 +1,18 @@ +<html> +<head> +<script> + document.addEventListener('DOMContentLoaded', () => { + const area = document.createElementNS('http://www.w3.org/1999/xhtml', 'area') + document.documentElement.appendChild(area) + area.setAttribute('href', '') + for (let i = 0; i < 16; i++) { + area.setAttribute('download', '') + } + area.click() + object = document.createElementNS('http://www.w3.org/1999/xhtml', 'object') + document.documentElement.appendChild(object) + setTimeout("location.reload()", 100) + }) + </script> +</head> +</html> diff --git a/dom/base/crashtests/1665792.html b/dom/base/crashtests/1665792.html new file mode 100644 index 0000000000..8cdef78dde --- /dev/null +++ b/dom/base/crashtests/1665792.html @@ -0,0 +1,30 @@ +<html class="reftest-wait"> +<script> +let pp; +window.addEventListener("MozReftestInvalidate", finish); +window.onload = () => { + window[0].stop() + window[0].onpagehide = document.createElement("frameset").onload + a.src = "" + setTimeout(function() { + pp = SpecialPowers.wrap(window).printPreview(); + pp?.close(); + setTimeout(finish, 0); + }, 0); +} + +let num = 0; +function finish() { + num++; + if (num < 2) { + return; + } + setTimeout(function () { + try { pp.close(); } catch (e) {} + document.documentElement.className = ""; + }, 0); +} + + +</script> +<iframe id="a"></iframe> diff --git a/dom/base/crashtests/1681729-inner1.html b/dom/base/crashtests/1681729-inner1.html new file mode 100644 index 0000000000..5aca8e6221 --- /dev/null +++ b/dom/base/crashtests/1681729-inner1.html @@ -0,0 +1 @@ +<iframe srcdoc="<iframe srcdoc="<p>Test">"> diff --git a/dom/base/crashtests/1681729-inner2.html b/dom/base/crashtests/1681729-inner2.html new file mode 100644 index 0000000000..5aca8e6221 --- /dev/null +++ b/dom/base/crashtests/1681729-inner2.html @@ -0,0 +1 @@ +<iframe srcdoc="<iframe srcdoc="<p>Test">"> diff --git a/dom/base/crashtests/1681729.html b/dom/base/crashtests/1681729.html new file mode 100644 index 0000000000..beb608eec9 --- /dev/null +++ b/dom/base/crashtests/1681729.html @@ -0,0 +1,30 @@ +<html class="reftest-wait"> +<head> +<script> + async function test() { + // We need to go through the event loop first, so we're running this from + // a timeout set from the load event. If we were adding a load from the load + // event directly we'd just replace the iframe's session history entry + // instead of cloning it (and replacing its children). + let frame = document.getElementById("frame"); + + let p = new Promise((r) => { + frame.addEventListener("load", r, { once: true }); + }); + frame.src = "1681729-inner2.html"; + await p; + + p = new Promise((r) => { + frame.contentWindow.addEventListener("pageshow", r, { once: true }); + }); + history.back(); + await p; + + document.documentElement.removeAttribute("class"); + } +</script> +</head> +<body onload="setTimeout(test, 0);"> +<iframe id="frame" src="1681729-inner1.html"></iframe> +</body> +</html> diff --git a/dom/base/crashtests/1693049.html b/dom/base/crashtests/1693049.html new file mode 100644 index 0000000000..9495aa39a2 --- /dev/null +++ b/dom/base/crashtests/1693049.html @@ -0,0 +1,30 @@ +<!DOCTYPE html> +<html> +<head> + <style> + + * { + all: initial; + display: table-row-group !important + } + </style> + <script> + window.addEventListener('load', () => { + const mspace = document.getElementById('id_0') + const tfoot = document.createElement('tfoot') + const h5 = document.createElement('h5') + document.documentElement.appendChild(tfoot) + document.documentElement.appendChild(h5) + const range = new Range() + range.setStart(tfoot, NaN) + setTimeout(async () => selection.extend(h5, Nan), 107) + const selection = document.getSelection() + selection.addRange(range) + selection.modify('move', 'backward', 'character') + range.surroundContents(mspace) + }) + </script> +</head> +<mspace id='id_0'></mspace> +<input type='reset'> +</html> diff --git a/dom/base/crashtests/1697256.html b/dom/base/crashtests/1697256.html new file mode 100644 index 0000000000..25024083e3 --- /dev/null +++ b/dom/base/crashtests/1697256.html @@ -0,0 +1,14 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<meta charset="utf-8"> +<script> + window.onload = () => { + window.requestIdleCallback(() => { + SpecialPowers.wrap(self).printPreview() + setTimeout(() => { + document.documentElement.classList.remove("reftest-wait"); + }, 250) + }) + } +</script> +<select autofocus='true'> diff --git a/dom/base/crashtests/1697525.html b/dom/base/crashtests/1697525.html new file mode 100644 index 0000000000..9935f331c2 --- /dev/null +++ b/dom/base/crashtests/1697525.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<script> + let pp; + window.addEventListener("MozReftestInvalidate", finish); + window.addEventListener('load', () => { + pp = SpecialPowers.wrap(self).printPreview(); + pp?.print(); + }); + function finish() { + setTimeout(function() { + pp.close(); + document.documentElement.className = ""; + }, 0); + } +</script> +</html> diff --git a/dom/base/crashtests/1700237.html b/dom/base/crashtests/1700237.html new file mode 100644 index 0000000000..779998b4f8 --- /dev/null +++ b/dom/base/crashtests/1700237.html @@ -0,0 +1,31 @@ + +<style> +:not(cursor) { + column-count: 1; + user-select: none; +} +</style> +<script> +document.addEventListener("DOMContentLoaded", () => { + window.getSelection().modify("move", "backward", "line") + const interval = setInterval(() => { + const m = new MutationObserver(() => { + let x = document.getSelection().getRangeAt(0) + a.appendChild(document.createElement("optgroup")) + try { + x.comparePoint(document.activeElement, 1) + } catch (error) { + clearInterval(interval) + return + } + + }) + m.observe(b, {attributes: true}) + b.setAttribute("x", "false") + }, 100) +}) +</script> +<hr contenteditable="true"> +<shadow id="a"> +<select autofocus="autofocus">a</select> +<div id="b">a</div> diff --git a/dom/base/crashtests/1712198.html b/dom/base/crashtests/1712198.html new file mode 100644 index 0000000000..c65c171ab6 --- /dev/null +++ b/dom/base/crashtests/1712198.html @@ -0,0 +1,25 @@ +<html class="reftest-wait"> +<script> +let pp; +window.addEventListener("MozReftestInvalidate", finish); +document.addEventListener('DOMContentLoaded', () => { + let a = document.documentElement + pp = SpecialPowers.wrap(self).printPreview(); + pp.document.adoptNode(a) + let b = document.createElementNS('http://www.w3.org/1999/xhtml', 'optgroup') + a.appendChild(b) + b.focus({ }) +}); +function finish() { + setTimeout(function () { + try { pp.close(); } catch (e) { } + document.documentElement.className = ""; + }, 0); +} +// we don't get a MozReftestInvalidate event because the reftest-wait class +// on the document element can't be seen by the reftest harness because the +// documentElement gets removed from the document, so we use onbeforeunload to +// close the window. +onbeforeunload = finish; +</script> +</html> diff --git a/dom/base/crashtests/1728670-1-child.html b/dom/base/crashtests/1728670-1-child.html new file mode 100644 index 0000000000..04dc33c9fa --- /dev/null +++ b/dom/base/crashtests/1728670-1-child.html @@ -0,0 +1,12 @@ +<html> +<script> +document.documentElement.clientHeight; +document.body.clientHeight; +</script> +<body> +<script> +document.documentElement.clientHeight; +document.body.clientHeight; +</script> +</body> +</html> diff --git a/dom/base/crashtests/1728670-1.html b/dom/base/crashtests/1728670-1.html new file mode 100644 index 0000000000..71fc842200 --- /dev/null +++ b/dom/base/crashtests/1728670-1.html @@ -0,0 +1,3 @@ +<html> +<iframe src="http://example.org/1728670-1-child.html" style="display: none;"> +</html> diff --git a/dom/base/crashtests/1757923.html b/dom/base/crashtests/1757923.html new file mode 100644 index 0000000000..d8e25a3a08 --- /dev/null +++ b/dom/base/crashtests/1757923.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html> + <head> + <script> + class CustomElement extends HTMLElement { + constructor () { + super(); + } + } + + let element = document.createElement("custom-element"); + customElements.define("custom-element", CustomElement); + customElements.upgrade(element); + + const internals = element.attachInternals(); + element = undefined; + SpecialPowers.forceGC(); + SpecialPowers.forceCC(); + internals.shadowRoot; + </script> + </head> +</html> diff --git a/dom/base/crashtests/1766472.html b/dom/base/crashtests/1766472.html new file mode 100644 index 0000000000..80462766d1 --- /dev/null +++ b/dom/base/crashtests/1766472.html @@ -0,0 +1,20 @@ +<!DOCTYPE html> +<html> +<head> + <script id="worker1" type="javascript/worker"> + self.onmessage = async function (e) { + const abort = new AbortController() + self.close() + try { await self.scheduler.postTask(async () => abort.abort(undefined), { 'signal': abort.signal }) } catch (e) {} + self.queueMicrotask(async () => abort.abort(undefined)) + } + </script> + <script> + document.addEventListener('DOMContentLoaded', () => { + const blob = new Blob([document.querySelector('#worker1').textContent], { type: 'text/javascript' }) + const worker = new Worker(window.URL.createObjectURL(blob)) + worker.postMessage([], []) + }) + </script> +</head> +</html> diff --git a/dom/base/crashtests/1780790.html b/dom/base/crashtests/1780790.html new file mode 100644 index 0000000000..0bc4364763 --- /dev/null +++ b/dom/base/crashtests/1780790.html @@ -0,0 +1,15 @@ +<html class="reftest-wait"> + <head> + <script> + function test() { + let ac = new AbortController(); + scheduler.postTask(()=> { ac.abort(); throw "Foobar"; }, { signal: ac.signal }); + scheduler.postTask(()=> document.documentElement.removeAttribute('class')); + } + </script> + <style> + </style> + </head> + <body onload="test()"> + </body> +</html> diff --git a/dom/base/crashtests/1811939.html b/dom/base/crashtests/1811939.html new file mode 100644 index 0000000000..73dbbb4ce6 --- /dev/null +++ b/dom/base/crashtests/1811939.html @@ -0,0 +1,7 @@ +<html class="reftest-wait"> +<script> + import("data:text/javascript,0").catch(x => 0); + import("data:text/javascript,0").catch(x => 0); + setTimeout('document.documentElement.className = ""', 500); + window.stop(); +</script> diff --git a/dom/base/crashtests/1822717-module.js b/dom/base/crashtests/1822717-module.js new file mode 100644 index 0000000000..f4180c02c1 --- /dev/null +++ b/dom/base/crashtests/1822717-module.js @@ -0,0 +1,56 @@ +// Large (hence OMT compiled) module with a syntax error. + +this is a syntax error + +/* +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789 +*/ diff --git a/dom/base/crashtests/1822717.html b/dom/base/crashtests/1822717.html new file mode 100644 index 0000000000..e328b209c7 --- /dev/null +++ b/dom/base/crashtests/1822717.html @@ -0,0 +1 @@ +<script type="module" src="1822717-module.js"></script> diff --git a/dom/base/crashtests/1835886.html b/dom/base/crashtests/1835886.html new file mode 100644 index 0000000000..3e681b15b5 --- /dev/null +++ b/dom/base/crashtests/1835886.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html> + <head> + <meta charset="utf-8" /> + </head> + <body> + <script> + const iframe = document.createElement("iframe"); + document.body.appendChild(iframe); + const subdocument = iframe.contentDocument; + const script = subdocument.createElement("script"); + const importPath = String(new URL("1835886.js", window.location)); + script.textContent = `import(${JSON.stringify(importPath)})`; + subdocument.body.appendChild(script); + </script> + </body> +</html> diff --git a/dom/base/crashtests/1835886.js b/dom/base/crashtests/1835886.js new file mode 100644 index 0000000000..71ffb47250 --- /dev/null +++ b/dom/base/crashtests/1835886.js @@ -0,0 +1 @@ +console.log("hello from mod"); diff --git a/dom/base/crashtests/1836824.html b/dom/base/crashtests/1836824.html new file mode 100644 index 0000000000..39a507771c --- /dev/null +++ b/dom/base/crashtests/1836824.html @@ -0,0 +1,9 @@ +<script> +document.addEventListener("DOMContentLoaded", () => { + const a = document.createElement("canvas") + document.body.appendChild(a); + a.captureStream(18.89); + a.getContext("2d"); + document.body.removeChild(a); +}) +</script> diff --git a/dom/base/crashtests/1838484.html b/dom/base/crashtests/1838484.html new file mode 100644 index 0000000000..4bf748454b --- /dev/null +++ b/dom/base/crashtests/1838484.html @@ -0,0 +1,23 @@ +<html class="reftest-wait"> + <script> + let pp; + let num = 0; + window.addEventListener("MozReftestInvalidate", finish); + window.requestIdleCallback(() => { + pp = SpecialPowers.wrap(self).printPreview(); + pp?.print(); + finish(); + }); + function finish() { + num++; + if (num < 2) { + return; + } + setTimeout(function() { + pp.close(); + document.documentElement.className = ""; + }, 0); + } + </script> + <template></template> +</html> diff --git a/dom/base/crashtests/1840191.html b/dom/base/crashtests/1840191.html new file mode 100644 index 0000000000..5c3c7f6c32 --- /dev/null +++ b/dom/base/crashtests/1840191.html @@ -0,0 +1,68 @@ +<head> +<script> +function go() { + document.onreadystatechange = () => { a.submit() } + window.stop() +} +</script> +</head> +<!-- a --> +<body> +<wbr> +<map> +<output> +<fieldset> +<keygen> +</fieldset> +<iframe></iframe> +<h1> +<form> +</bgsound> +</option> +</form> +<data> +<form id="a" target="b"> +<output> +<output> +<picture> +<pre></pre> +</data> +<output> +<textarea onfocus="go()" autofocus=""> +</textarea> +<dl> +<dt> +<input> +</dt> +<dt> +<dd> +<table> +<marquee> +<frameset> +<frame> +</frame> +</frameset> +<bdo> +<canvas> +<video> +<input> +<time> +<keygen> +<audio> +<track> +<source> +<select> +<optgroup> +<option> +<option> +</select> +<bdi> +<h4> +<img> +<sub> +<picture> +<h4> +<link> +<link> +<!-- a --> +</html> diff --git a/dom/base/crashtests/205225-1.html b/dom/base/crashtests/205225-1.html new file mode 100644 index 0000000000..26576d4d5c --- /dev/null +++ b/dom/base/crashtests/205225-1.html @@ -0,0 +1,9 @@ +<html> +<head> +<script type="text/javascript"> +document.createTreeWalker(null, NodeFilter.SHOW_ALL, null); +</script> +</head> +<body> +</body> +</html> diff --git a/dom/base/crashtests/231475-1.html b/dom/base/crashtests/231475-1.html new file mode 100644 index 0000000000..4a0d997daa --- /dev/null +++ b/dom/base/crashtests/231475-1.html @@ -0,0 +1,12 @@ +<html><body> +<script type="text/javascript"> +//function doBold(){ +range = document.createRange(); +newNode = document.createElement("b"); +range.selectNodeContents(document); + +range.surroundContents(newNode) +//} +</script> +text +</body></html>
\ No newline at end of file diff --git a/dom/base/crashtests/244933-1.html b/dom/base/crashtests/244933-1.html new file mode 100644 index 0000000000..7eaf96cc31 --- /dev/null +++ b/dom/base/crashtests/244933-1.html @@ -0,0 +1,13 @@ +<html>
+<body>
+<pre>
+<script>
+document.write(window.sidebar.something);
+for (i in window.sidebar)
+{
+ break
+}
+</script>
+</pre>
+</body>
+</html>
diff --git a/dom/base/crashtests/275912-1.html b/dom/base/crashtests/275912-1.html new file mode 100644 index 0000000000..08b5bc5fc5 --- /dev/null +++ b/dom/base/crashtests/275912-1.html @@ -0,0 +1,2 @@ +<HTML>
+><><BODY onLoad=*><
\ No newline at end of file diff --git a/dom/base/crashtests/293388-1.html b/dom/base/crashtests/293388-1.html new file mode 100644 index 0000000000..5c2e5c53c9 --- /dev/null +++ b/dom/base/crashtests/293388-1.html @@ -0,0 +1,26 @@ +<html class="reftest-wait"><head><title>Testcase bug 293388 - Overwriting of div innerHTML cause starting of the loading icon(circle) and some times browser can crash [@ nsRange::DeleteContents]</title></head> +<script> +function reallyClear() +{ + var par = document.getElementById("par"); + var range = document.createRange(); + range.selectNodeContents(par); + range.deleteContents(); + document.documentElement.removeAttribute("class"); +} + +function clear() +{ + document.body.removeEventListener("DOMNodeRemoved", clear); + reallyClear(); +} + +function init() +{ + document.body.addEventListener("DOMNodeRemoved", clear); +} + +</script> +<body onload="init(); setTimeout(reallyClear, 10);"> +<div id="par"><span>1</span><span>2</span></div> +</body></html>
\ No newline at end of file diff --git a/dom/base/crashtests/325730-1.html b/dom/base/crashtests/325730-1.html new file mode 100644 index 0000000000..113f697abc --- /dev/null +++ b/dom/base/crashtests/325730-1.html @@ -0,0 +1,27 @@ +<html> + +<head> + +<script> + +function init() +{ + document.addEventListener("DOMNodeRemoved", meep); + document.body.appendChild(document.getElementById("b")); + + function meep() + { + document.removeEventListener("DOMNodeRemoved", meep); + document.body.removeChild(document.getElementById("c")); + } +} + +window.addEventListener("load", init); + + +</script> + +</head> + +<body><div id="b"></div><div id="c"></div></body> +</html>
\ No newline at end of file diff --git a/dom/base/crashtests/326618-1.html b/dom/base/crashtests/326618-1.html new file mode 100644 index 0000000000..926670ab63 --- /dev/null +++ b/dom/base/crashtests/326618-1.html @@ -0,0 +1,14 @@ +<html> +<head> +</head> +<body> +<script> + +try { + document.body.removeChild(function(){}); +} catch (e) { +} + +</script> +</body> +</html> diff --git a/dom/base/crashtests/326646-1.html b/dom/base/crashtests/326646-1.html new file mode 100644 index 0000000000..5b654dd02c --- /dev/null +++ b/dom/base/crashtests/326646-1.html @@ -0,0 +1,22 @@ +<html> +<head> + +<script> + +var dt; + +function init() { + dt = document.implementation.createDocumentType("rheet", 0, 2); + dt.foopy = "quux"; +} + +init(); + +</script> + +</head> + +<body> + +</body> +</html> diff --git a/dom/base/crashtests/326865-1.html b/dom/base/crashtests/326865-1.html new file mode 100644 index 0000000000..579e95c9ce --- /dev/null +++ b/dom/base/crashtests/326865-1.html @@ -0,0 +1,12 @@ +<html> +<head> +<script> +try { + window.getComputedStyle(null); +} catch (e) { +} +</script> +</head> +<body> +</body> +</html> diff --git a/dom/base/crashtests/327571-1.html b/dom/base/crashtests/327571-1.html new file mode 100644 index 0000000000..117f093510 --- /dev/null +++ b/dom/base/crashtests/327571-1.html @@ -0,0 +1,22 @@ +<html> +<head> +<script> + +function init() +{ + + var x = document.getElementById("d"); + x.__proto__ = document.getElementById("f"); + x.inputname; +} + +</script> +</head> + +<body onload="init();"> + +<div id="d"></div> +<form id="f"><input name="inputname"></form> + +</body> +</html> diff --git a/dom/base/crashtests/327694.html b/dom/base/crashtests/327694.html new file mode 100644 index 0000000000..132c02cf82 --- /dev/null +++ b/dom/base/crashtests/327694.html @@ -0,0 +1,17 @@ +<html>
<head>
+ +<script>
+ +function init() +{ + var y = document.getElementById("tt"); + var z = y.firstChild; + y.removeChild(z); + z.text; +} + +window.addEventListener("load", init); + +</script> +
</head>
<body>
<div id="tt"><a href="http://www.mozilla.org">Foo</a></div>
+
</body>
</html> diff --git a/dom/base/crashtests/327695-1.html b/dom/base/crashtests/327695-1.html new file mode 100644 index 0000000000..a3d5562b3a --- /dev/null +++ b/dom/base/crashtests/327695-1.html @@ -0,0 +1,10 @@ +<html> +<head> +<script> +document.createTextNode("").__proto__.__proto__ = null; +document.createTextNode(""); +</script> +</head> +<body> +</body> +</html> diff --git a/dom/base/crashtests/329481-1.xhtml b/dom/base/crashtests/329481-1.xhtml new file mode 100644 index 0000000000..3ba5477f3d --- /dev/null +++ b/dom/base/crashtests/329481-1.xhtml @@ -0,0 +1,12 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<body> +<p>This page made Firefox leak domwindows and documents.</p> +<span onmouseover="1"></span> +<script> +try { + window.__proto__ = document.createElement("div"); +} catch(e) { +} +</script> +</body> +</html> diff --git a/dom/base/crashtests/336381-1.xhtml b/dom/base/crashtests/336381-1.xhtml new file mode 100644 index 0000000000..eac3eeb57a --- /dev/null +++ b/dom/base/crashtests/336381-1.xhtml @@ -0,0 +1,29 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script> + +function boom() +{ + var zz = document.getElementById("d").childNodes[0]; + + zz.parentNode.removeChild(zz); + + var r = document.createRange(); + r.setStart(zz, 0); + r.setEnd(zz, 0); + + try { + r.insertNode(document.createTextNode('5')); + } catch (e) { + } +} + +</script> +</head> + +<body onload="boom()"> + +<div id="d">3</div> + +</body> +</html> diff --git a/dom/base/crashtests/336715-1.xhtml b/dom/base/crashtests/336715-1.xhtml new file mode 100644 index 0000000000..ad9d1430ad --- /dev/null +++ b/dom/base/crashtests/336715-1.xhtml @@ -0,0 +1,40 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait"> +<head> +<script> +<![CDATA[ + +function funn() +{ + var q = document.getElementById("q"); + + var start1 = document.getElementById("start1"); + var end1 = document.getElementById("end1"); + + var start2 = q; // div + var end2 = q.previousSibling; // text node + + var r = document.createRange(); + r.setStart(start1, 0); + r.setEnd(end1, 0); + r.deleteContents(); + + // the offsets for start2 and end2 must be the same to trigger the assertion + var s = document.createRange(); + s.setStart(start2, 0); + s.setEnd(end2, 0); + + document.documentElement.removeAttribute("class"); +} + +]]> +</script> + +</head> + +<body onload="setTimeout(funn, 30)"> + <div id="start1"></div> + <div id="t">X<div id="q">Y</div></div> + <div id="end1"></div> +</body> + +</html> diff --git a/dom/base/crashtests/338391-1.xhtml b/dom/base/crashtests/338391-1.xhtml new file mode 100644 index 0000000000..9366e0c0fd --- /dev/null +++ b/dom/base/crashtests/338391-1.xhtml @@ -0,0 +1,33 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait"> +<head> + +<script> + +function boom() +{ + var n = document.getElementById("n"); + + document.addEventListener("DOMNodeRemoved", foozle, false); + n.parentNode.removeChild(n); + document.removeEventListener("DOMNodeRemoved", foozle, false); + + function foozle() + { + document.removeEventListener("DOMNodeRemoved", foozle, false); // prevent accidental recursion + + n.parentNode.removeChild(n); + + document.documentElement.removeAttribute("class"); + } +} + +</script> + +</head> + +<body onload="setTimeout(boom, 30)"> + +<div id="n"></div> + +</body> +</html> diff --git a/dom/base/crashtests/338674-1.xhtml b/dom/base/crashtests/338674-1.xhtml new file mode 100644 index 0000000000..2cba227dcd --- /dev/null +++ b/dom/base/crashtests/338674-1.xhtml @@ -0,0 +1,36 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait"> +<head> + +<script> + +function boom() +{ + var s = document.getElementById("s") + var t = s.previousSibling; // a whitespace text node.. + + document.addEventListener("DOMAttrModified", bang, false); + rM(s); + document.removeEventListener("DOMAttrModified", bang, false); + + function bang(ev) { + document.removeEventListener("DOMAttrModified", bang, false); // avoid accidental recursion, multiple calls, etc. + rM(t); + } + + document.documentElement.removeAttribute("class"); +} + +function rM(n) { n.parentNode.removeChild(n); } + +</script> + +</head> + +<body onload="setTimeout(boom, 1);"> + +<div><select><option>C</option></select></div> + +<span id="s">A <div>B</div></span> + +</body> +</html> diff --git a/dom/base/crashtests/340733-1.html b/dom/base/crashtests/340733-1.html new file mode 100644 index 0000000000..26d8fb9cdf --- /dev/null +++ b/dom/base/crashtests/340733-1.html @@ -0,0 +1,28 @@ +<html class="reftest-wait"> + +<head> +<script type="text/javascript"> + + +function boom() +{ + var map = document.getElementById("map"); + var table = document.getElementById("table"); + + map.appendChild(table); + map.childNodes[0].appendChild(document.createTextNode(' ')); + + document.documentElement.removeAttribute("class"); +} + +</script> +</head> + +<body onload="setTimeout(boom, 30);"> + +<img src="../../../testing/crashtest/images/tree.gif" usemap="#map"> +<map name="map" id="map"><area></map> +<table aardvark="aardvark" id="table"><tbody><tr><td>Table</td></tr></tbody></table> + +</body> +</html> diff --git a/dom/base/crashtests/343730-1.xhtml b/dom/base/crashtests/343730-1.xhtml new file mode 100644 index 0000000000..82b5a26a8a --- /dev/null +++ b/dom/base/crashtests/343730-1.xhtml @@ -0,0 +1,35 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait"> +<head> + +<script> +<![CDATA[ + +var div; + +function boo() +{ + var newSpan = document.createElement('span'); + div = document.getElementById('div'); + + var newScript = document.createElement('script'); + var nt = document.createTextNode("document.body.removeChild(div);"); + newScript.appendChild(nt); + newSpan.appendChild(newScript); + + div.appendChild(newSpan); + + document.documentElement.removeAttribute("class"); +} + +]]> +</script> + +</head> + +<body onload="setTimeout(boo, 30);"> + +<div id="div"></div> + +</body> + +</html> diff --git a/dom/base/crashtests/343850-1.xhtml b/dom/base/crashtests/343850-1.xhtml new file mode 100644 index 0000000000..4bf313062d --- /dev/null +++ b/dom/base/crashtests/343850-1.xhtml @@ -0,0 +1,28 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait"> +<head> + +<script> +<![CDATA[ + +function boom() +{ + var div = document.getElementById("div"); + var embed = document.getElementById("embed"); + embed.setAttribute("src", "javascript:'QQQQ'"); + embed.removeAttribute("src"); + document.body.appendChild(div); + + document.documentElement.removeAttribute("class"); +} + +]]> +</script> + +</head> + +<body onload="setTimeout(boom, 30);"> + +<div id="div"><embed id="embed"/></div> + +</body> +</html> diff --git a/dom/base/crashtests/343889-1.html b/dom/base/crashtests/343889-1.html new file mode 100644 index 0000000000..8ea8bc28d3 --- /dev/null +++ b/dom/base/crashtests/343889-1.html @@ -0,0 +1,18 @@ +<Html class="reftest-wait"> +<head> +<meta http-equiv="content-type" content="text/html; charset=utf8"> +</head> +<body onload="boom()"> +<iframe src="#" id="data"></iframe> +<script> +function boom() { +var d=document.getElementById('data').contentDocument; +d.clear() +var text='Тест'; +d.write(text); +d.close(); +document.documentElement.removeAttribute("class"); +} +</script> +</body> +</html> diff --git a/dom/base/crashtests/344434-1.xhtml b/dom/base/crashtests/344434-1.xhtml new file mode 100644 index 0000000000..28c5fc0e49 --- /dev/null +++ b/dom/base/crashtests/344434-1.xhtml @@ -0,0 +1,24 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait"> + +<head> +<script> + +var XUL_NS = 'http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul'; + +function foopy() +{ + document.getElementsByTagName("div")[0].appendChild(document.createElement("div")); + document.body.appendChild(document.createElementNS(XUL_NS, "toolbarpalette")) + document.body.appendChild(document.createElementNS(XUL_NS, "toolbar")) + + document.documentElement.removeAttribute("class"); +} + +</script> +</head> + +<body onload="setTimeout(foopy, 30);"> + <div>A</div> +</body> + +</html> diff --git a/dom/base/crashtests/344882-1.html b/dom/base/crashtests/344882-1.html new file mode 100644 index 0000000000..6a8dd69d5b --- /dev/null +++ b/dom/base/crashtests/344882-1.html @@ -0,0 +1,33 @@ +<html class="reftest-wait"> +<head> +<script> +var obj; + +function boo() +{ + obj = document.getElementById("obj"); + setScriptSrc(); +} + +function setScriptSrc() +{ + obj.data = "javascript:setScriptSrc2();"; +} + +function setScriptSrc2() +{ + obj.data = "javascript:void 0"; + + document.documentElement.removeAttribute("class"); +} + +</script> +</head> + +<body onload="setTimeout(boo, 30);"> + +<object data="../../../testing/crashtest/images/tree.gif" id="obj"> + +</body> + +</html> diff --git a/dom/base/crashtests/345837-1.xhtml b/dom/base/crashtests/345837-1.xhtml new file mode 100644 index 0000000000..a1f010c5e2 --- /dev/null +++ b/dom/base/crashtests/345837-1.xhtml @@ -0,0 +1,35 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait"> + +<head> +<script> +<![CDATA[ + +function foo() +{ + var r = document.createRange(); + r.setStart(document.getElementById("a"), 0); + r.setEnd(document.getElementById("b"), 0); + window.getSelection().addRange(r); + + var everything = document.getElementById("everything"); + everything.remove(); + + document.documentElement.removeAttribute("class"); +} + +]]> +</script> +</head> + +<body onload="setTimeout(foo, 30);"> + +<div id="everything"> + +<div id="a"> + <span id="b" /> +</div> + +</div> + +</body> +</html> diff --git a/dom/base/crashtests/346381-1.html b/dom/base/crashtests/346381-1.html new file mode 100644 index 0000000000..4d0263d804 --- /dev/null +++ b/dom/base/crashtests/346381-1.html @@ -0,0 +1,16 @@ +<html> + +<head> +</head> + +<body onload="window.zoop = document.getElementById('paz');"> + +<p>Loading this page should not make Firefox leak DOMWindows or documents.</p> + +<div id="paz"> +<span onmouseover="6"></span> +</div> + +</body> + +</html> diff --git a/dom/base/crashtests/349355-1.html b/dom/base/crashtests/349355-1.html new file mode 100644 index 0000000000..627bdc6d61 --- /dev/null +++ b/dom/base/crashtests/349355-1.html @@ -0,0 +1,41 @@ +<html class="reftest-wait"> +<head> +<script> + +function zap() +{ + var j = document.getElementById("j"); + j.remove(); + document.documentElement.removeAttribute("class"); +} + +</script> + +</head> +<body onload="setTimeout(zap, 1);"> + + +<div> + + <form> + <fieldset> + <div id="j"> + <div> + <div> + <span> + <input type="submit"> + <label></label> + </span> + </div> + </div> + + </div> + </fieldset> + </form> + +</div> + + +</body> + +</html> diff --git a/dom/base/crashtests/359432-1.xhtml b/dom/base/crashtests/359432-1.xhtml new file mode 100644 index 0000000000..391a4d1622 --- /dev/null +++ b/dom/base/crashtests/359432-1.xhtml @@ -0,0 +1,27 @@ +<html xmlns="http://www.w3.org/1999/xhtml" + xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" + class="reftest-wait"> + +<head> + +<script> + +function boo() +{ + var tabbox = document.getElementById("tabbox"); + document.body.removeChild(tabbox); + tabbox.setAttribute("context", "a"); + document.documentElement.removeAttribute("class"); +} + +</script> + +</head> + +<body onload="setTimeout(boo, 30)"> + +<xul:tabbox id="tabbox" /> + +</body> + +</html> diff --git a/dom/base/crashtests/360599-1.html b/dom/base/crashtests/360599-1.html new file mode 100644 index 0000000000..c090088c0f --- /dev/null +++ b/dom/base/crashtests/360599-1.html @@ -0,0 +1,25 @@ +<html> +<head> +<style> +#b::first-letter { } +#c::first-line { } +</style> +<title>Testcase bug 360599 - Crash [@ nsFrameList::DestroyFrames] with first-letter/first-line css and position: fixed</title> +</head> +<body> +This page should not crash Mozilla +<div id="c"> + <table> + <div id="b" style="display:table-header-group;"> + <q> + text + <div style="position:fixed;"> + <q>y</q> + </div> + </q> + </div> + <span style="display: table;"></span> +</div> + +</body> +</html>
\ No newline at end of file diff --git a/dom/base/crashtests/366200-1.xhtml b/dom/base/crashtests/366200-1.xhtml new file mode 100644 index 0000000000..a604990cf6 --- /dev/null +++ b/dom/base/crashtests/366200-1.xhtml @@ -0,0 +1,34 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> + +<head> +<script type="text/javascript"> + +<![CDATA[ + +function boom() +{ + var dE = document.documentElement; + var newSpan = document.createElementNS("http://www.w3.org/1999/xhtml", "span"); + + document.addEventListener("DOMNodeRemoved", whee); + document.removeChild(dE); + document.removeEventListener("DOMNodeRemoved", whee); + + function whee() + { + document.removeEventListener("DOMNodeRemoved", whee); + document.insertBefore(newSpan, dE); + } +} + +window.addEventListener("load", boom); + +]]> + +</script> +</head> + +<body> +<p>This text will disappear. There should be no assertions.</p> +</body> +</html> diff --git a/dom/base/crashtests/369219-1.xhtml b/dom/base/crashtests/369219-1.xhtml new file mode 100644 index 0000000000..b44242d262 --- /dev/null +++ b/dom/base/crashtests/369219-1.xhtml @@ -0,0 +1,19 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script> + +function boom() +{ + var select = document.getElementById("sss"); + select.options.add.call(null, 0); +} + +</script> +</head> + +<body onload="boom();"> + +<select id="sss"><option>foo</option></select> + +</body> +</html> diff --git a/dom/base/crashtests/369413-1.html b/dom/base/crashtests/369413-1.html new file mode 100644 index 0000000000..4fc3b7dfcc --- /dev/null +++ b/dom/base/crashtests/369413-1.html @@ -0,0 +1,12 @@ +<html> +<head> +<script> +try { atob(null); } catch(e) { } +try { atob(""); } catch(e) { } +try { atob("A="); } catch(e) { } +try { atob("AA="); } catch(e) { } +</script> +</head> +<body> +</body> +</html> diff --git a/dom/base/crashtests/371124-1-inner.html b/dom/base/crashtests/371124-1-inner.html new file mode 100644 index 0000000000..d8fb45519d --- /dev/null +++ b/dom/base/crashtests/371124-1-inner.html @@ -0,0 +1,21 @@ +<html> +<head> +<script> + +function boom() +{ + obj = document.getElementsByTagName("object")[0]; + obj.__proto__ = null; + for (p in obj) + dump(p + "\n"); +} + +</script> +</head> + +<body onload="setTimeout(boom, 200);"> + +<object></object> + +</body> +</html>
\ No newline at end of file diff --git a/dom/base/crashtests/371124-1.html b/dom/base/crashtests/371124-1.html new file mode 100644 index 0000000000..ccefd3a324 --- /dev/null +++ b/dom/base/crashtests/371124-1.html @@ -0,0 +1,9 @@ +<html class="reftest-wait"> +<head> +<script> +setTimeout('document.documentElement.className = ""', 500); +</script> +<body> +<iframe src="371124-1-inner.html"></iframe> +</body> +</html> diff --git a/dom/base/crashtests/371124-2-inner.html b/dom/base/crashtests/371124-2-inner.html new file mode 100644 index 0000000000..7883093822 --- /dev/null +++ b/dom/base/crashtests/371124-2-inner.html @@ -0,0 +1,10 @@ +<html> +<body> + +<script> + document.all.tags.__proto__ = null; + alert(document.all.tags) +</script> + +</body> +</html>
\ No newline at end of file diff --git a/dom/base/crashtests/371124-2.html b/dom/base/crashtests/371124-2.html new file mode 100644 index 0000000000..93897635fa --- /dev/null +++ b/dom/base/crashtests/371124-2.html @@ -0,0 +1,9 @@ +<html class="reftest-wait"> +<head> +<script> +setTimeout('document.documentElement.className = ""', 500); +</script> +<body> +<iframe src="371124-2-inner.html"></iframe> +</body> +</html> diff --git a/dom/base/crashtests/371466-1.xhtml b/dom/base/crashtests/371466-1.xhtml new file mode 100644 index 0000000000..8da0b22b12 --- /dev/null +++ b/dom/base/crashtests/371466-1.xhtml @@ -0,0 +1,24 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait"> +<head> +<script> + +function boom() +{ + var marquee = document.getElementById("marquee"); + var span = document.getElementById("span"); + marquee.appendChild(span); + marquee.removeChild(span); + document.documentElement.removeAttribute("class"); +} + +</script> +</head> + +<body onload="setTimeout(boom, 30);"> + +<marquee id="marquee" /> + +<span id="span"><div>Foo</div><textarea/></span> + +</body> +</html> diff --git a/dom/base/crashtests/372554-1.html b/dom/base/crashtests/372554-1.html new file mode 100644 index 0000000000..a87edcecbf --- /dev/null +++ b/dom/base/crashtests/372554-1.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<head> +<script> +function boom() +{ + if (location.protocol == "file:") { + try { + location.hostname = 'foo'; + } catch(e) { + } + } + + document.documentElement.removeAttribute("class"); +} +</script> +</head> +<body onload="setTimeout(boom, 30)"> + +</body> + +</html> diff --git a/dom/base/crashtests/375399-1-inner.xhtml b/dom/base/crashtests/375399-1-inner.xhtml new file mode 100644 index 0000000000..46573b49cd --- /dev/null +++ b/dom/base/crashtests/375399-1-inner.xhtml @@ -0,0 +1,12 @@ +<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:svg="http://www.w3.org/2000/svg"> +<svg:foreignObject x="0" y="0" width="100%" height="100%"> +<xul:tabs onselect="window.frameElement.parentNode.removeChild(window.frameElement)"><xul:tree id="t"/></xul:tabs> +</svg:foreignObject> + +<html:script> +function doe() { +document.getElementById('t'); +} +setTimeout(doe, 200); +</html:script> +</html>
\ No newline at end of file diff --git a/dom/base/crashtests/375399-1.html b/dom/base/crashtests/375399-1.html new file mode 100644 index 0000000000..8e50c7ef35 --- /dev/null +++ b/dom/base/crashtests/375399-1.html @@ -0,0 +1,11 @@ +<html class="reftest-wait"> +<head> +<title>Testcase bug 375399 - Crash [@ nsElementSH::PostCreate] when removing window when accessing xul:tree in xul:tabs onselect in svg:foreignObject</title> +<script> +setTimeout('document.documentElement.className = ""', 500); +</script> +</head> +<body> +<iframe id="content" src="./375399-1-inner.xhtml"></iframe> +</body> +</html> diff --git a/dom/base/crashtests/377360-1.xhtml b/dom/base/crashtests/377360-1.xhtml new file mode 100644 index 0000000000..77fa300bef --- /dev/null +++ b/dom/base/crashtests/377360-1.xhtml @@ -0,0 +1,19 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script> + +function boom() +{ + var div = document.getElementById("div"); + div.textContent = String.fromCharCode(0xDCBF); +} + +</script> +</head> + +<body onload="boom();"> + +<div id="div"></div> + +</body> +</html> diff --git a/dom/base/crashtests/377960-1.html b/dom/base/crashtests/377960-1.html new file mode 100644 index 0000000000..c61002eeea --- /dev/null +++ b/dom/base/crashtests/377960-1.html @@ -0,0 +1,12 @@ +<html><head>
+
+</head>
+<body onblur="document.activeElement.style.display = 'none'" tabindex="4" onfocus="var x=document.getElementsByTagName('*');var i = Math.floor(Math.random()*x.length);x[i].focus()" style="overflow: scroll;">
+
+
+
+<iframe tabindex="2" style="overflow: scroll; display: inline; position: fixed; direction: rtl;"></iframe>
+
+<select onblur="event.target.setAttribute('tabindex', Math.floor(Math.random()*5)-9)" style="overflow: scroll; display: table; position: absolute; float: right; direction: rtl;"></select>
+
+</body></html>
\ No newline at end of file diff --git a/dom/base/crashtests/377960-2.html b/dom/base/crashtests/377960-2.html new file mode 100644 index 0000000000..dc42dc00d2 --- /dev/null +++ b/dom/base/crashtests/377960-2.html @@ -0,0 +1,7 @@ +<html>
+<head><title>Click the <select> to crash.</title></head>
+<body onfocus="document.documentElement.focus(); document.body.style.display = 'none';">
+<iframe style="position: fixed;"></iframe>
+<select style="position: absolute;"></select>
+</body>
+</html>
diff --git a/dom/base/crashtests/384663-1-inner.xhtml b/dom/base/crashtests/384663-1-inner.xhtml new file mode 100644 index 0000000000..f2914ce0aa --- /dev/null +++ b/dom/base/crashtests/384663-1-inner.xhtml @@ -0,0 +1,18 @@ +<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"> +<tree> + <splitter style="overflow: scroll;"> + <treecols style="overflow: scroll; display: block;"> + <treeitem id="mw_b" style=" display: list-item;"/> + </treecols> + </splitter> +</tree> + +<script xmlns="http://www.w3.org/1999/xhtml"> +function doe() { +window.addEventListener('DOMAttrModified', function(e) {document.removeChild(document.documentElement); }, true); + var y=document.getElementById('mw_b'); + y.parentNode.removeChild(y); +} +setTimeout(doe, 200); +</script> +</window>
\ No newline at end of file diff --git a/dom/base/crashtests/384663-1.html b/dom/base/crashtests/384663-1.html new file mode 100644 index 0000000000..d357dfd8ad --- /dev/null +++ b/dom/base/crashtests/384663-1.html @@ -0,0 +1,9 @@ +<html class="reftest-wait"> +<head> +<script> +setTimeout('document.documentElement.className = ""', 500); +</script> +<body> +<iframe src="384663-1-inner.xhtml"></iframe> +</body> +</html> diff --git a/dom/base/crashtests/386000-1.html b/dom/base/crashtests/386000-1.html new file mode 100644 index 0000000000..0363f0b693 --- /dev/null +++ b/dom/base/crashtests/386000-1.html @@ -0,0 +1,36 @@ +<!DOCTYPE HTML> +<html class="reftest-wait"> +<head> +<script> + +var de; + +function boom() +{ + de = document.documentElement; + document.addEventListener("DOMNodeRemoved", f); + + function f() + { + document.removeEventListener("DOMNodeRemoved", f); + de.appendChild(document.createElement("body")); + } + + document.removeChild(de); + + setTimeout(cont, 30); +} + +function cont() +{ + document.appendChild(de); + document.documentElement.removeAttribute("class"); +} + +</script> + +</head> +<body onload="setTimeout(boom, 30);"> + +</body> +</html> diff --git a/dom/base/crashtests/386794-1.html b/dom/base/crashtests/386794-1.html new file mode 100644 index 0000000000..4b50221688 --- /dev/null +++ b/dom/base/crashtests/386794-1.html @@ -0,0 +1,17 @@ +<!DOCTYPE HTML> +<html> +<head> +<script> + +function boom() +{ + var weirdScript = document.createElementNS('http://example.com/foo', 'script'); + document.body.appendChild(weirdScript); + document.body.innerHTML; +} + +</script> +</head> +<body onload="boom()"> +</body> +</html> diff --git a/dom/base/crashtests/387460-1-inner.xhtml b/dom/base/crashtests/387460-1-inner.xhtml new file mode 100644 index 0000000000..33b1891e7b --- /dev/null +++ b/dom/base/crashtests/387460-1-inner.xhtml @@ -0,0 +1,22 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head></head> +<body> +<a id="a" href="#"></a> + +<table><tbody> +<tr><td id="d"/></tr> +<tr id="b"><td id="c"></td></tr> +</tbody></table> + + +<script> +function doe() { + document.getElementById('b').appendChild(document.getElementById('c')); + window.addEventListener('DOMAttrModified', function(e){document.getElementById('a').focus();}, true); + document.getElementById('d').setAttribute('rowspan', 3); +} +setTimeout(doe, 200); +</script> + +</body> +</html>
\ No newline at end of file diff --git a/dom/base/crashtests/387460-1.html b/dom/base/crashtests/387460-1.html new file mode 100644 index 0000000000..bd1fc9353c --- /dev/null +++ b/dom/base/crashtests/387460-1.html @@ -0,0 +1,9 @@ +<html class="reftest-wait"> +<head> +<script> +setTimeout('document.documentElement.className = ""', 1000); +</script> +<body> +<iframe src="387460-1-inner.xhtml"></iframe> +</body> +</html> diff --git a/dom/base/crashtests/399712-1.html b/dom/base/crashtests/399712-1.html new file mode 100644 index 0000000000..58e9573090 --- /dev/null +++ b/dom/base/crashtests/399712-1.html @@ -0,0 +1,29 @@ +<html class="reftest-wait"> +<head> +<script> + +function boom() +{ + document.getElementById("ta").style.overflow = "scroll"; + setTimeout(boom2, 12); +} + +function boom2() +{ + document.getElementById("ta").style.overflow = ""; + setTimeout(boom, 12); +} + +function cont() +{ + document.documentElement.removeAttribute("class"); +} +</script> +</head> + +<body onload="boom(); setTimeout(cont, 800);"> + +<textarea id="ta">x</textarea> + +</body> +</html> diff --git a/dom/base/crashtests/400763-1.html b/dom/base/crashtests/400763-1.html new file mode 100644 index 0000000000..2de6720908 --- /dev/null +++ b/dom/base/crashtests/400763-1.html @@ -0,0 +1,7 @@ +<html> +<head> +<script src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12NgYPgPAAEDAQDZqt2zAAAAAElFTkSuQmCC" charset="UTF-8"></script> +</head> +<body> +</body> +</html> diff --git a/dom/base/crashtests/407818.html b/dom/base/crashtests/407818.html new file mode 100644 index 0000000000..eea475be42 --- /dev/null +++ b/dom/base/crashtests/407818.html @@ -0,0 +1,5 @@ +<html> +<head> +</head> +<body contenteditable="true" onload="document.execCommand('selectAll', false, null);"><ol> <li></li></ol></body> +</html> diff --git a/dom/base/crashtests/410860-1.xml b/dom/base/crashtests/410860-1.xml new file mode 100644 index 0000000000..4a7414fc9b --- /dev/null +++ b/dom/base/crashtests/410860-1.xml @@ -0,0 +1,8 @@ +<svg xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink" + onload="document.getElementById('x').getBoundingClientRect();"> + +<rect id="x"/> + +</svg> + diff --git a/dom/base/crashtests/411882-1.xhtml b/dom/base/crashtests/411882-1.xhtml new file mode 100644 index 0000000000..6cd121044f --- /dev/null +++ b/dom/base/crashtests/411882-1.xhtml @@ -0,0 +1 @@ +<html xmlns="http://www.w3.org/1999/xhtml"><body></body><textarea></textarea></html>
\ No newline at end of file diff --git a/dom/base/crashtests/416734-1.html b/dom/base/crashtests/416734-1.html new file mode 100644 index 0000000000..69350933c1 --- /dev/null +++ b/dom/base/crashtests/416734-1.html @@ -0,0 +1,13 @@ +<html> +<head> +</head> + +<body style="direction: rtl; visibility: collapse; white-space: pre;"><span style="display: -moz-inline-box;"><span><span style="font-size: 0pt; border: 1px dotted red; white-space: -moz-pre-wrap;"> + +X X } + + + </span> + </span></span></body> + +</html> diff --git a/dom/base/crashtests/417852-1.html b/dom/base/crashtests/417852-1.html new file mode 100644 index 0000000000..bf8ba34863 --- /dev/null +++ b/dom/base/crashtests/417852-1.html @@ -0,0 +1,13 @@ +<!DOCTYPE html> +<html> +<head> +<script type="text/javascript"> + +window.__proto__ = null; +Object.prototype.__proto__ = window; + +</script> +</head> +<body> +</body> +</html> diff --git a/dom/base/crashtests/418928-1.html b/dom/base/crashtests/418928-1.html new file mode 100644 index 0000000000..a3e42fe6f3 --- /dev/null +++ b/dom/base/crashtests/418928-1.html @@ -0,0 +1,10 @@ +<!DOCTYPE html> +<html> +<head> +</head> +<body onload="document.execCommand('selectAll', false, null);"> + +<select><option contenteditable="true">A</option></select> + +</body> +</html> diff --git a/dom/base/crashtests/420620-1.html b/dom/base/crashtests/420620-1.html new file mode 100644 index 0000000000..74ae6dcbe3 --- /dev/null +++ b/dom/base/crashtests/420620-1.html @@ -0,0 +1,29 @@ +<!DOCTYPE html> +<html> +<head> +<script type="text/javascript"> + +function boom() +{ + var a = document.documentElement; + var b = document.body; + + document.removeChild(a); + b.contentEditable = "true"; + document.appendChild(a); + + function t() { + document.removeEventListener("DOMAttrModified", t); + document.removeChild(a); + } + + document.addEventListener("DOMAttrModified", t); + document.execCommand("insertunorderedlist", false, "<h1>"); + document.removeEventListener("DOMAttrModified", t); +} + +</script> +</head> + +<body onload="boom()"></body> +</html> diff --git a/dom/base/crashtests/424276-1.html b/dom/base/crashtests/424276-1.html new file mode 100644 index 0000000000..feb39bf33d --- /dev/null +++ b/dom/base/crashtests/424276-1.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + window.getSelection().selectAllChildren(document.createTextNode("\n\n")); + window.getSelection().addRange(document.createRange()); +} + +</script> +</head> + +<body onload="boom();"></body> + +</html> diff --git a/dom/base/crashtests/426987-1.html b/dom/base/crashtests/426987-1.html new file mode 100644 index 0000000000..7d277156e1 --- /dev/null +++ b/dom/base/crashtests/426987-1.html @@ -0,0 +1,7 @@ +<html> +<head> +</head> +<body> +<iframe src="data:text/html,<html><body onunload="parent.document.body.style.overflow = 'auto';"></body></html>"></iframe> +</body> +</html> diff --git a/dom/base/crashtests/43040-1.html b/dom/base/crashtests/43040-1.html new file mode 100644 index 0000000000..00165763c4 --- /dev/null +++ b/dom/base/crashtests/43040-1.html @@ -0,0 +1,19 @@ +<HTML>
+<HEAD>
+<META NAME="GENERATOR" Content="Microsoft Visual Studio 6.0">
+<script>
+var xmlDoc;
+
+function createDoc()
+{
+ var xmlDoc = document.implementation.createDocument("", "", null);
+ var xmlElem = xmlDoc.firstChild;
+ xmlElem.appendChild(document.createTextNode("blabla"));
+ xmlElem.firstChild.nodeValue;
+}
+</script>
+
+</HEAD>
+<BODY onload="createDoc();">
+</BODY>
+</HTML>
diff --git a/dom/base/crashtests/439206-1.html b/dom/base/crashtests/439206-1.html new file mode 100644 index 0000000000..688ebe44d5 --- /dev/null +++ b/dom/base/crashtests/439206-1.html @@ -0,0 +1,19 @@ +<!DOCTYPE html> +<html> +<head> +<script type="text/javascript"> + +function boom() +{ + var s = document.createElement("STYLE"); + var t = document.createTextNode("\uDB00x"); // a high surrogate followed by 'x' + document.documentElement.appendChild(s); + s.appendChild(t); +} + +</script> +</head> + +<body onload="boom();"> +</body> +</html> diff --git a/dom/base/crashtests/443538-1.svg b/dom/base/crashtests/443538-1.svg new file mode 100644 index 0000000000..cb7388a7cd --- /dev/null +++ b/dom/base/crashtests/443538-1.svg @@ -0,0 +1,7 @@ +<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:xlink="http://www.w3.org/1999/xlink"
+ onload="document.getElementById('use').removeChild(document.getElementById('s'));">
+
+ <use id="use" xlink:href="#s"><g id="s"/></use>
+
+</svg>
diff --git a/dom/base/crashtests/448615-1.html b/dom/base/crashtests/448615-1.html new file mode 100644 index 0000000000..bfb4f365a1 --- /dev/null +++ b/dom/base/crashtests/448615-1.html @@ -0,0 +1,13 @@ +<!DOCTYPE html> +<html> +<head> +<style type="text/css"> + +div:first-letter { float: right; } + +</style> +</head> + +<body><div>A</div></body> + +</html> diff --git a/dom/base/crashtests/450383-1.html b/dom/base/crashtests/450383-1.html new file mode 100644 index 0000000000..3c95b966ce --- /dev/null +++ b/dom/base/crashtests/450383-1.html @@ -0,0 +1,9 @@ +<html> +<BODY></BODY> +<SCRIPT> + document.addEventListener("DOMCharacterDataModified",function(){ + document.body.innerHTML=""; // change this to see memory corruption + },true); + document.body.innerHTML="<optGroup</form<textArea"; +</SCRIPT> +</html> diff --git a/dom/base/crashtests/450385-1.html b/dom/base/crashtests/450385-1.html new file mode 100644 index 0000000000..e75159c51d --- /dev/null +++ b/dom/base/crashtests/450385-1.html @@ -0,0 +1,11 @@ +<html> +<BODY></BODY> +<SCRIPT> +document.body.addEventListener("DOMCharacterDataModified", function () { + document.body.innerHTML = ""; + eventChild.appendChild(event.relatedNode); +}, true); +document.addEventListener("DOMNodeInserted", function () {}, true); +document.body.innerHTML="]<kbd><small></kbd><base><optGroup></optGroup>"; +</SCRIPT> +</html> diff --git a/dom/base/crashtests/458637-1-inner.xhtml b/dom/base/crashtests/458637-1-inner.xhtml new file mode 100644 index 0000000000..f91d6e5b4c --- /dev/null +++ b/dom/base/crashtests/458637-1-inner.xhtml @@ -0,0 +1,4 @@ +<?xml-stylesheet type="text/xsl" href="#a"?> +<html xmlns="http://www.w3.org/1999/xhtml"> +<xsl:stylesheet version="1.0" id="a" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"/> +</html>
\ No newline at end of file diff --git a/dom/base/crashtests/458637-1.html b/dom/base/crashtests/458637-1.html new file mode 100644 index 0000000000..124846fcbe --- /dev/null +++ b/dom/base/crashtests/458637-1.html @@ -0,0 +1,29 @@ +<html class="reftest-wait"> +<head> +<script type="text/javascript"> + +var iterations = 0; +var start = new Date(); + +function boom() +{ + document.getElementById("i").style.overflow = "scroll"; + document.getElementById("i").src = document.getElementById("i").src; + setTimeout(boom2, 10); // must be a short timeout +} + +function boom2() +{ + document.getElementById("i").style.overflow = ""; + var now = new Date(); + if (++iterations < 20 && now - start < 5000) + setTimeout(boom, 10); + else + document.documentElement.removeAttribute("class"); +} + +</script> +</head> + +<body onload="boom();"><iframe id="i" src="458637-1-inner.xhtml" style="visibility: collapse;"></iframe></body> +</html> diff --git a/dom/base/crashtests/462947.html b/dom/base/crashtests/462947.html new file mode 100644 index 0000000000..09581b3081 --- /dev/null +++ b/dom/base/crashtests/462947.html @@ -0,0 +1,13 @@ +<!DOCTYPE html> +<html> +<head> +<script type="text/javascript"> + +navigator.mimeTypes.length; +navigator.mimeTypes.length; + +</script> +</head> + +<body></body> +</html> diff --git a/dom/base/crashtests/467392.html b/dom/base/crashtests/467392.html new file mode 100644 index 0000000000..a64044c6ea --- /dev/null +++ b/dom/base/crashtests/467392.html @@ -0,0 +1,4 @@ +<script> +document.write(document.body.innerHTML); +window.location.reload(); +</script> diff --git a/dom/base/crashtests/472593-1.html b/dom/base/crashtests/472593-1.html new file mode 100644 index 0000000000..ad8fe34bfa --- /dev/null +++ b/dom/base/crashtests/472593-1.html @@ -0,0 +1,7 @@ +<!DOCTYPE html>
+<html>
+<head>
+<body onload="document.getElementById('t').value = '';">
+<textarea rows="10" cols="1" wrap="hard" id="t">		</textarea>
+</body>
+</html>
diff --git a/dom/base/crashtests/474041-1.svg b/dom/base/crashtests/474041-1.svg new file mode 100644 index 0000000000..2b8351472c --- /dev/null +++ b/dom/base/crashtests/474041-1.svg @@ -0,0 +1,17 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" onload="boom();"> + +<rect id="r"/><use id="u" xlink:href="#r"><rect id="r"/></use> + +<script type="text/javascript"> + +function boom() +{ + var r1 = document.getElementsByTagName("rect")[0]; // the first node with id="r" + var use = document.getElementById("u"); + document.documentElement.insertBefore(use, r1); + r1.appendChild(use); +} + +</script> + +</svg> diff --git a/dom/base/crashtests/476526.html b/dom/base/crashtests/476526.html new file mode 100644 index 0000000000..b3d8f8e1c8 --- /dev/null +++ b/dom/base/crashtests/476526.html @@ -0,0 +1,10 @@ +<!DOCTYPE HTML>
+<html>
+<body>
+<iframe src="data:text/xml,
+ <html xmlns='http://www.w3.org/1999/xhtml'
+ onDOMAttrModified='window.frameElement.parentNode.removeChild(window.frameElement)'>
+ </html>"
+ onload="event.target.contentDocument.documentElement.setAttribute('x', 'y');"></iframe>
+</body>
+</html>
diff --git a/dom/base/crashtests/483818-1.html b/dom/base/crashtests/483818-1.html new file mode 100644 index 0000000000..11cc7c4aca --- /dev/null +++ b/dom/base/crashtests/483818-1.html @@ -0,0 +1,14 @@ +<!DOCTYPE html> +<html> + <head> + <script> +function appendScript(doc) { + var s = doc.createElement("script"); + s.textContent = "document.write('executed'); document.close()"; + doc.body.appendChild(s); +} + </script> + </head> + <body onload="appendScript(window.document)"> + </body> +</html> diff --git a/dom/base/crashtests/490760-1.xhtml b/dom/base/crashtests/490760-1.xhtml new file mode 100644 index 0000000000..988f7c12ba --- /dev/null +++ b/dom/base/crashtests/490760-1.xhtml @@ -0,0 +1,25 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script type="text/javascript"> +<![CDATA[ + +function boom() +{ + var q = document.getElementsByTagName("style")[0]; + + window.addEventListener("DOMNodeRemoved", f); + q.innerHTML = "<span><\/span>"; + window.removeEventListener("DOMNodeRemoved", f); + + function f() + { + window.removeEventListener("DOMNodeRemoved", f); + q.removeChild(q.childNodes[1]); + } +} + +]]> +</script> +</head> +<body onload="boom();"><style><span></span><span></span></style></body> +</html> diff --git a/dom/base/crashtests/493281-1.html b/dom/base/crashtests/493281-1.html new file mode 100644 index 0000000000..6dd3dd4a15 --- /dev/null +++ b/dom/base/crashtests/493281-1.html @@ -0,0 +1,7 @@ +<html> + <body> + <div id="foo"> + <script>with (document.all) foo</script> + </div> + </body> +</html> diff --git a/dom/base/crashtests/493281-2.html b/dom/base/crashtests/493281-2.html new file mode 100644 index 0000000000..2369624694 --- /dev/null +++ b/dom/base/crashtests/493281-2.html @@ -0,0 +1,12 @@ +<html> + <body> + <div id="foo"> + <script> + function get(x) { return x } + obj = {}; + obj.__proto__ = get(document.all); + obj.foo + </script> + </div> + </body> +</html> diff --git a/dom/base/crashtests/494810-1.html b/dom/base/crashtests/494810-1.html new file mode 100644 index 0000000000..e0036cd836 --- /dev/null +++ b/dom/base/crashtests/494810-1.html @@ -0,0 +1,15 @@ +<html> +<head> +<script type="text/javascript"> + +function boom() +{ + document.domain = "["; + window.sessionStorage; +} + +</script> +</head> + +<body onload="boom();"></body> +</html> diff --git a/dom/base/crashtests/499006-1.html b/dom/base/crashtests/499006-1.html new file mode 100644 index 0000000000..f02720b847 --- /dev/null +++ b/dom/base/crashtests/499006-1.html @@ -0,0 +1,26 @@ +<html> +<head> +<script type="text/javascript"> + +function select(start, startOffset, end, endOffset) { + var sel = getSelection(); + sel.removeAllRanges(); + var range = document.createRange(); + range.setStart(start, startOffset); + range.setEnd(end, endOffset); + sel.addRange(range); +} + +function boom() { + var p = document.body; + select(p.childNodes[0],0,p.childNodes[0],1); + sel = getSelection(); + range = sel.getRangeAt(0); + range.detach(); + range.insertNode(p); +} + +</script> +</head> +<body onload="boom()"><span>Hello Kitty</span></body> +</html> diff --git a/dom/base/crashtests/499006-2.html b/dom/base/crashtests/499006-2.html new file mode 100644 index 0000000000..86907c5bb6 --- /dev/null +++ b/dom/base/crashtests/499006-2.html @@ -0,0 +1,35 @@ +<html> +<head> +<script>
+function extractc(j) {
+var sel = window.getSelection();
+
+
+var b=document.getElementById('b');
+
+var range =document.createRange();
+range.setStart(document.documentElement, 0);
+range.setEnd(document.documentElement, 0);
+sel.addRange(range);
+range.extractContents();
+
+range.setStart(b, 0);
+range.setEnd(b, 0);
+sel.addRange(range);
+range.extractContents();
+
+
+range.setStart(b, 0);
+range.setEnd(b, 0);
+sel.addRange(range);
+range.extractContents();
+
+
+}
+setTimeout(extractc,200,0);
+</script> +<title id="b"></title> +</head> +<body> +</body> +</html>
\ No newline at end of file diff --git a/dom/base/crashtests/502617.html b/dom/base/crashtests/502617.html new file mode 100644 index 0000000000..4d4487817f --- /dev/null +++ b/dom/base/crashtests/502617.html @@ -0,0 +1,13 @@ +<!DOCTYPE html> +<html> +<head> +<script type="text/javascript"> + +var a = {}; +a instanceof HTMLImageElement; + +</script> +</head> + +<body></body> +</html> diff --git a/dom/base/crashtests/504224.html b/dom/base/crashtests/504224.html new file mode 100644 index 0000000000..713085166b --- /dev/null +++ b/dom/base/crashtests/504224.html @@ -0,0 +1,29 @@ +<html class="reftest-wait"> +<head> +<title>Crash [@ nsFocusManager::GetClosestCommonInclusiveAncestor], part 2</title> +</head> +<body> +<script> +function oniframeload() { + window.frames[0].location.reload(); +}; +</script> +<iframe src="file_504224.html" id="content" onload="oniframeload();" ></iframe> +<script> +var src='file_504224.html'; +setInterval(function() { + var x = document.getElementById('content'); + if (!x) { + x=document.createElement('iframe'); + x.src=src; + x.id = 'content'; + document.body.appendChild(x); + setTimeout(function() { + window.focus(); + document.documentElement.removeAttribute('class'); + }, 100); + } +}, 500); +</script> +</body> +</html> diff --git a/dom/base/crashtests/509536-1.html b/dom/base/crashtests/509536-1.html new file mode 100644 index 0000000000..9881646013 --- /dev/null +++ b/dom/base/crashtests/509536-1.html @@ -0,0 +1,17 @@ +<!DOCTYPE HTML> +<html> +<head> +<script type="text/javascript"> + +function boom() +{ + var frame = document.createElement("iframe"); + frame.setAttribute("src", "1"); + document.body.appendChild(frame); + frame.setAttribute("src", "2"); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/base/crashtests/522516-1.html b/dom/base/crashtests/522516-1.html new file mode 100644 index 0000000000..87891ea198 --- /dev/null +++ b/dom/base/crashtests/522516-1.html @@ -0,0 +1,10 @@ +<!DOCTYPE html> +<html> +<body onload="document.getElementById('a').appendChild(document.getElementById('b'));"> + +<div id="b"></div> +<div style="filter: url(#b);"></div> +<div id="a"></div> + +</body> +</html> diff --git a/dom/base/crashtests/529670.html b/dom/base/crashtests/529670.html new file mode 100644 index 0000000000..52e66ab8c2 --- /dev/null +++ b/dom/base/crashtests/529670.html @@ -0,0 +1,18 @@ +<!DOCTYPE HTML> +<html><head> + <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> + <title>Testcase for bug 529670</title> +<script> +function boom() { + document.createRange().getClientRects() + document.createRange().getBoundingClientRect() + + var range = document.createRange(); + range.detach(); + range.getClientRects() + range.getBoundingClientRect() +} +</script> +</head> +<body onload="boom()"></body> +</html> diff --git a/dom/base/crashtests/535926-1.html b/dom/base/crashtests/535926-1.html new file mode 100644 index 0000000000..b59c10cbdd --- /dev/null +++ b/dom/base/crashtests/535926-1.html @@ -0,0 +1,28 @@ +<html class="reftest-wait"> +<head> + +<script type="text/javascript"> + +var i = 0; +function mmf() +{ + if (++i == 2) { + document.body.innerHTML = "<marquee>"; + document.documentElement.removeAttribute("class"); + } +} + +function init() +{ + document.documentElement.offsetHeight; + for (var j = 0; j < 2; ++j) { + var iframe = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe"); + iframe.addEventListener("load", mmf); + document.body.appendChild(iframe); + } +} + +</script> +</head> +<body onload="setTimeout(init, 0);"></body> +</html> diff --git a/dom/base/crashtests/543645.html b/dom/base/crashtests/543645.html new file mode 100644 index 0000000000..c9b80f4cdf --- /dev/null +++ b/dom/base/crashtests/543645.html @@ -0,0 +1,14 @@ +<!doctype html> +<body> <span></span> <script> +function boom() { + var range = document.createRange(); + range.setEnd(document.body.childNodes[2], 0); + window.addEventListener("DOMNodeInserted", f, true); + function f() { + window.removeEventListener("DOMNodeInserted", f, true); + range.deleteContents(); + } + range.deleteContents(); +} +window.addEventListener("load", boom); +</script> diff --git a/dom/base/crashtests/551631-1.html b/dom/base/crashtests/551631-1.html new file mode 100644 index 0000000000..90a84ce584 --- /dev/null +++ b/dom/base/crashtests/551631-1.html @@ -0,0 +1,22 @@ +<!DOCTYPE HTML> +<html> +<head> +<base href="javascript:5"> +<script> + +function boom() +{ + var head = document.getElementsByTagName("head")[0]; + var s = document.createElement("script"); + s.async = "async"; + s.src = "useBaseHrefAndFail"; + s.q = "q"; + head.appendChild(s); + head.removeChild(s); +} + +</script> +</head> + +<body onload="boom();"></body> +</html> diff --git a/dom/base/crashtests/552651.html b/dom/base/crashtests/552651.html new file mode 100644 index 0000000000..7db14f52a4 --- /dev/null +++ b/dom/base/crashtests/552651.html @@ -0,0 +1,25 @@ +<!DOCTYPE HTML> +<html class="reftest-wait"> +<head> + <title>Testcase for bug 552651</title> + <script class="testbody" type="text/javascript"> + +function testCancel() { + var xhr = new XMLHttpRequest(); + xhr.addEventListener("readystatechange", function(e) { + if (xhr.readyState == 3) // NOTE : only leaks for state == 3 + xhr.abort(); + else if (xhr.readyState == 4) + document.documentElement.className = ""; + }); + + xhr.open("GET", "552651.xml", true); + xhr.send(); +} +</script> +</head> +<body onload="testCancel()"> +This test should not leak... +</body> +</html> + diff --git a/dom/base/crashtests/552651.xml b/dom/base/crashtests/552651.xml new file mode 100644 index 0000000000..b04b966cfa --- /dev/null +++ b/dom/base/crashtests/552651.xml @@ -0,0 +1,2 @@ +<foo>test</foo> + diff --git a/dom/base/crashtests/554230-1.xhtml b/dom/base/crashtests/554230-1.xhtml new file mode 100644 index 0000000000..28801ccfa4 --- /dev/null +++ b/dom/base/crashtests/554230-1.xhtml @@ -0,0 +1,15 @@ +<html class="reftest-wait" xmlns="http://www.w3.org/1999/xhtml"><iframe contenteditable="true"></iframe><span></span><script style="display: none;" id="fuzz1" type="text/javascript"> +<![CDATA[ + +function boom() +{ + document.getElementsByTagName("iframe")[0].focus(); + document.getElementsByTagName("span")[0].appendChild(document.createElementNS("http://www.w3.org/1999/xhtml", "div")); + document.execCommand("selectAll", false, null); + document.documentElement.removeAttribute("class"); +} + +window.addEventListener("load", boom); + +]]> +</script></html> diff --git a/dom/base/crashtests/558973.html b/dom/base/crashtests/558973.html new file mode 100644 index 0000000000..878b8c9259 --- /dev/null +++ b/dom/base/crashtests/558973.html @@ -0,0 +1,17 @@ +<!DOCTYPE HTML> +<html> +<head> +<script type="text/javascript"> + +var child = document.createTextNode("a"); + +var attr = document.createAttribute("a"); +try { + attr.appendChild(child); +} +catch (e) { +} + +</script> +</head> +</html> diff --git a/dom/base/crashtests/564079-1.html b/dom/base/crashtests/564079-1.html new file mode 100644 index 0000000000..1c97ff9677 --- /dev/null +++ b/dom/base/crashtests/564079-1.html @@ -0,0 +1,10 @@ +<!DOCTYPE html> +<html> +<head> +<script type="text/javascript"> + +document.createTextNode("x").lookupPrefix(""); + +</script> +</head> +</html> diff --git a/dom/base/crashtests/564114.html b/dom/base/crashtests/564114.html new file mode 100644 index 0000000000..93786e2221 --- /dev/null +++ b/dom/base/crashtests/564114.html @@ -0,0 +1,11 @@ +<html> +<head> +<script type="text/javascript"> + +document.documentElement.compareDocumentPosition(null); + +</script> +</head> + +<body></body> +</html> diff --git a/dom/base/crashtests/565125-1.html b/dom/base/crashtests/565125-1.html new file mode 100644 index 0000000000..ceeb923f4c --- /dev/null +++ b/dom/base/crashtests/565125-1.html @@ -0,0 +1,27 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var a = document.createTextNode(" "); + (document.documentElement).appendChild(a); + var b = document.createElement("span"); + (document.documentElement).appendChild(b); + var c = document.createTextNode(" "); + (document.documentElement).appendChild(c); + var r = document.createRange(); + r.setStart(a, 0); + r.setEnd(c, 0); + try { + r.surroundContents(document.documentElement); + } catch(e) { + } + document.documentElement.appendChild(b); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/base/crashtests/575462.svg b/dom/base/crashtests/575462.svg new file mode 100644 index 0000000000..8131d5f1fd --- /dev/null +++ b/dom/base/crashtests/575462.svg @@ -0,0 +1,27 @@ +<?xml version="1.0"?> + +<svg xmlns="http://www.w3.org/2000/svg"> + +<g id="a"><g id="b"/></g> + +<script type="text/javascript"> +<![CDATA[ + +function j() +{ + var a = document.getElementById("a"); + var b = document.getElementById("b"); + window.addEventListener("DOMAttrModified", k, true); + function k() + { + window.removeEventListener("DOMAttrModified", k, true); + a.appendChild(b); + } + b.removeAttribute("id"); +} + +window.addEventListener("load", j, false); + +]]> +</script> +</svg> diff --git a/dom/base/crashtests/582601.html b/dom/base/crashtests/582601.html new file mode 100644 index 0000000000..4fb854a42c --- /dev/null +++ b/dom/base/crashtests/582601.html @@ -0,0 +1,12 @@ +<html> +<head> + <title>Crashtest</title> +<script> +var attr = document.createAttribute("foo"); +attr.lookupPrefix(""); +</script> +</head> +<body> + +</body> +</html> diff --git a/dom/base/crashtests/590395-1.html b/dom/base/crashtests/590395-1.html new file mode 100644 index 0000000000..3b653c5e71 --- /dev/null +++ b/dom/base/crashtests/590395-1.html @@ -0,0 +1,5 @@ +<html> +<body onload="document.createElement('div').appendChild(document.getElementById('i').contentDocument.getElementById('j'));"> +<iframe id="i" src="data:text/html,<img id='j' src='about:blank'>"> +</body> +</html> diff --git a/dom/base/crashtests/593302-1.html b/dom/base/crashtests/593302-1.html new file mode 100644 index 0000000000..96d731cfb4 --- /dev/null +++ b/dom/base/crashtests/593302-1.html @@ -0,0 +1,29 @@ +<!DOCTYPE html> +<html class="reftest-wait"> + <head> + <script type="text/javascript"> + function boom() + { + iframe = document.getElementById("iframe"); + iframeBody = iframe.contentDocument.body; + iframeBody.appendChild(makeNamedSpan("w")); + remove(iframe); + iframeBody.appendChild(makeNamedSpan("w")); + remove(iframeBody); + document.documentElement.className = ""; + } + + function makeNamedSpan(i) + { + var s = document.createElement("span"); + s.id = i; + return s; + } + + function remove(n) { n.remove(); } + </script> + </head> + <body onload="boom();"> + <iframe id="iframe" srcdoc="<html>S</html>"></iframe> + </body> +</html> diff --git a/dom/base/crashtests/593302-2.html b/dom/base/crashtests/593302-2.html new file mode 100644 index 0000000000..60e77d4881 --- /dev/null +++ b/dom/base/crashtests/593302-2.html @@ -0,0 +1,12 @@ +<!DOCTYPE html> +<html> + <body> + <!-- This test should not leak. --> + <iframe src="data:text/html, + <script> + var elem = document.createElement('span'); + document.mozSetImageElement('foo', elem); + elem.foo = document; + </script>"></iframe> + </body> +</html> diff --git a/dom/base/crashtests/595606-1.html b/dom/base/crashtests/595606-1.html new file mode 100644 index 0000000000..82cae26363 --- /dev/null +++ b/dom/base/crashtests/595606-1.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html class="reftest-wait"> + <body onload=" + document.body.removeChild(document.getElementById('x')); + document.documentElement.removeAttribute('class');"> + + <div id="x"> + <div id="a"> + <form id="a"> + <select></select> + </form> + </div> + </div> + + <select form="a"></select> + </body> +</html> diff --git a/dom/base/crashtests/595606-2.html b/dom/base/crashtests/595606-2.html new file mode 100644 index 0000000000..3cab264c0d --- /dev/null +++ b/dom/base/crashtests/595606-2.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html class="reftest-wait"> + <body onload=" + document.body.removeChild(document.getElementById('x')); + document.documentElement.removeAttribute('class');"> + + <div id="x"> + <form id="a"> + <select></select> + </form> + <form id="a"> + <select></select> + </form> + </div> + + <select form="a"></select> + </body> +</html> diff --git a/dom/base/crashtests/601247.html b/dom/base/crashtests/601247.html new file mode 100644 index 0000000000..6eb9f46574 --- /dev/null +++ b/dom/base/crashtests/601247.html @@ -0,0 +1,8 @@ +<!DOCTYPE html> +<script> + +var x = document.createTextNode("x"); +x.__proto__ = localStorage; +for (var p in x) {}; + +</script> diff --git a/dom/base/crashtests/603531.html b/dom/base/crashtests/603531.html new file mode 100644 index 0000000000..8243e462e1 --- /dev/null +++ b/dom/base/crashtests/603531.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var frame = document.getElementById("f"); + var frameWindow = frame.contentWindow; + document.body.removeChild(frame); + document.body.setUserData("x", frameWindow, null); + document.body.setUserData("x", "", null); +} + +</script> +</head> +<body onload="boom();"><iframe id="f" src="data:text/html,"></iframe></body> +</html> diff --git a/dom/base/crashtests/604262-1.html b/dom/base/crashtests/604262-1.html new file mode 100644 index 0000000000..4ece25e855 --- /dev/null +++ b/dom/base/crashtests/604262-1.html @@ -0,0 +1,8 @@ +<!DOCTYPE html> +<script> + +var inputElem = document.createElementNS("http://www.w3.org/1999/xhtml", "input"); +inputElem.QueryInterface(Ci.imgIDecoderObserver); +inputElem.onStartDecode(null); + +</script> diff --git a/dom/base/crashtests/605672-1.svg b/dom/base/crashtests/605672-1.svg new file mode 100644 index 0000000000..b929b26691 --- /dev/null +++ b/dom/base/crashtests/605672-1.svg @@ -0,0 +1,17 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> + +<script> +function boom() +{ + var fr = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe"); + fr.src = "data:text/html,X"; + document.documentElement.appendChild(fr); + var docType = fr.contentDocument.implementation.createDocumentType(undefined, "", ""); + document.removeChild(document.documentElement); + document.appendChild(docType); +} + +window.addEventListener("load", boom, false); +</script> + +</svg> diff --git a/dom/base/crashtests/606729-1.html b/dom/base/crashtests/606729-1.html new file mode 100644 index 0000000000..c81479c20b --- /dev/null +++ b/dom/base/crashtests/606729-1.html @@ -0,0 +1 @@ +<script async src="data:">0</script> diff --git a/dom/base/crashtests/607222.html b/dom/base/crashtests/607222.html new file mode 100644 index 0000000000..a9491b3429 --- /dev/null +++ b/dom/base/crashtests/607222.html @@ -0,0 +1,21 @@ +<html><body> +<script> + + function G(str){ + var cobj=document.createElement(str); + document.body.appendChild(cobj); + cobj.scrollWidth; + } + + function crashme() { + document.write("fooFOO"); + G("a"); + document.write("<a lang></a>a"); + G("base"); + document.write("barBAR"); + G("audio"); + } +</script> +<script>crashme();</script> +</body> +</html> diff --git a/dom/base/crashtests/609560-1.xhtml b/dom/base/crashtests/609560-1.xhtml new file mode 100644 index 0000000000..7849c8db73 --- /dev/null +++ b/dom/base/crashtests/609560-1.xhtml @@ -0,0 +1,31 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait"> +<head> +<script> +<![CDATA[ + +function x() +{ + var p = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe"); + var frame = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe"); + frame.onload = y; + frame.src = "data:text/html,1"; + document.body.appendChild(frame); + var frameRoot = frame.contentDocument.documentElement; + + function y() + { + var frameDoc = frameRoot.ownerDocument; + frameRoot.appendChild(p); + var attr = frameDoc.createAttributeNS("http://www.w3.org/1999/xhtml", "u"); + attr.w = {}; + p.setAttributeNode(attr); + document.documentElement.removeAttribute("class"); + } +} + +]]> +</script> +</head> + +<body onload="setTimeout(x, 0);"></body> +</html> diff --git a/dom/base/crashtests/610571-1.html b/dom/base/crashtests/610571-1.html new file mode 100644 index 0000000000..96dbc22719 --- /dev/null +++ b/dom/base/crashtests/610571-1.html @@ -0,0 +1,26 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<head> +<script> + +function boom() +{ + var frame1 = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe"); frame1.src = "data:text/html,1"; document.body.appendChild(frame1); + var frame2 = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe"); frame2.src = "data:text/html,2"; document.body.appendChild(frame2); + var frame1doc = frame1.contentDocument; + var frame1root = frame1doc.documentElement; + frame1root.appendChild(frame2); + setTimeout(function() { + try { + frame2.contentDocument.q = frame1root.__lookupGetter__("nextSibling"); + } catch(ex) {} + document.documentElement.removeAttribute("class"); + }, 200); +} + +</script> +</head> + +<body onload="boom();"></body> +</html> + diff --git a/dom/base/crashtests/612018-1.html b/dom/base/crashtests/612018-1.html new file mode 100644 index 0000000000..7f81422a71 --- /dev/null +++ b/dom/base/crashtests/612018-1.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<head> +<script> + +function boom() +{ + var input = document.createElement("input"); + document.body.appendChild(input); + input.focus(); + document.body.appendChild(input); + input.focus(); + + document.documentElement.removeAttribute("class"); +} + +</script> +</head> + +<body onload="setTimeout(boom, 0);"></body> +</html> diff --git a/dom/base/crashtests/628599-1.html b/dom/base/crashtests/628599-1.html new file mode 100644 index 0000000000..09be38f1e0 --- /dev/null +++ b/dom/base/crashtests/628599-1.html @@ -0,0 +1,31 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +var w; + +function b1() +{ + w = window.open("404.gif", "w2", "f"); + setTimeout(b2, 1200); +} + +function b2() +{ + w.close(); + setTimeout(b3, 500); +} + +function b3() +{ + w.location = "data:text/html,2"; + document.body.appendChild(document.createTextNode("Done")); +} + +</script> +</head> +<body> +<div><button onclick="b1();">Start test</button></div> +</body> +</html> diff --git a/dom/base/crashtests/637116.html b/dom/base/crashtests/637116.html new file mode 100644 index 0000000000..422cbe7360 --- /dev/null +++ b/dom/base/crashtests/637116.html @@ -0,0 +1,29 @@ +<!DOCTYPE html> +<html> + +<head> +<script> + +function K(v) { return function() { return v; } } + +var errorProxy = new Proxy({}, {get: function() { throw new Error(); }}); + +function boom() +{ + var focused = document.createElementNS("http://www.w3.org/1999/xhtml", "input"); + document.body.appendChild(focused); + var otherWin = window.open("data:text/html,1", "_blank", "width=200,height=200"); + try { otherWin.history.replaceState(errorProxy, "title", "replaceState.html"); } catch(e) {} + focused.focus(); + focused.addEventListener("foo", K(otherWin.applicationCache)); + otherWin.close(); +} + +</script> +</head> + +<body onload="boom();"> +<button onclick="boom();">If you have popups blocked, click here to start the leak test</button> +</body> + +</html> diff --git a/dom/base/crashtests/637214-1.svg b/dom/base/crashtests/637214-1.svg new file mode 100644 index 0000000000..106428a297 --- /dev/null +++ b/dom/base/crashtests/637214-1.svg @@ -0,0 +1,26 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" class="reftest-wait"> + +<script> +<![CDATA[ + +window.addEventListener("load", function () { + document.documentElement.appendChild(document.getElementById("a")); + setTimeout(function () { + document.getElementById("x").setAttribute("id", "m1"); + document.documentElement.removeAttribute("class"); + }, 0); +}, false); + +]]> +</script> + +<g id="a"> + <path id="x"/> + <text> + <textPath xlink:href="#m1">Text</textPath> + <textPath xlink:href="#m1">Text</textPath> + + </text> +</g> + +</svg> diff --git a/dom/base/crashtests/637214-2.svg b/dom/base/crashtests/637214-2.svg new file mode 100644 index 0000000000..4f5c929277 --- /dev/null +++ b/dom/base/crashtests/637214-2.svg @@ -0,0 +1,26 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" class="reftest-wait"> + +<script> +<![CDATA[ + +window.addEventListener("load", function () { + document.documentElement.appendChild(document.getElementById("a")); + setTimeout(function () { + document.getElementById("x").removeAttribute("id"); + document.documentElement.removeAttribute("class"); + }, 0); +}, false); + +]]> +</script> + +<g id="a"> + <path id="x"/> + <text> + <textPath xlink:href="#m1">Text</textPath> + <textPath xlink:href="#m1">Text</textPath> + + </text> +</g> + +</svg> diff --git a/dom/base/crashtests/642022-1.html b/dom/base/crashtests/642022-1.html new file mode 100644 index 0000000000..b2bc59085f --- /dev/null +++ b/dom/base/crashtests/642022-1.html @@ -0,0 +1,4 @@ +<!DOCTYPE html> +<script> +InstallTrigger.constructor.create(window).setTimeout(Array, 0); +</script> diff --git a/dom/base/crashtests/646184.html b/dom/base/crashtests/646184.html new file mode 100644 index 0000000000..a4a6ac4907 --- /dev/null +++ b/dom/base/crashtests/646184.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var f = document.getElementById("f"); + var w = f.contentWindow; + f.remove(); + w.localStorage; +} + +</script> +</head> +<body onload="boom();"><iframe id="f" src="data:text/html,1"></iframe></body> +</html> diff --git a/dom/base/crashtests/658845-1.svg b/dom/base/crashtests/658845-1.svg new file mode 100644 index 0000000000..40a6a3167c --- /dev/null +++ b/dom/base/crashtests/658845-1.svg @@ -0,0 +1,3 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> + <use xlink:href="data:" /> +</svg> diff --git a/dom/base/crashtests/666869.html b/dom/base/crashtests/666869.html new file mode 100644 index 0000000000..ac11f64e12 --- /dev/null +++ b/dom/base/crashtests/666869.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var f = document.getElementById("f"); + var frameWin = f.contentWindow; + document.body.removeChild(f); + frameWin.performance; +} + +</script> +</head> +<body onload="boom();"><iframe id="f" src="data:text/html,1"></iframe></body> +</html> diff --git a/dom/base/crashtests/667336-1.html b/dom/base/crashtests/667336-1.html new file mode 100644 index 0000000000..499f5a9ef0 --- /dev/null +++ b/dom/base/crashtests/667336-1.html @@ -0,0 +1,4 @@ +<!DOCTYPE html> +<script> +document.createElement("div").children.item(-1); +</script> diff --git a/dom/base/crashtests/675516.xhtml b/dom/base/crashtests/675516.xhtml new file mode 100644 index 0000000000..0daadf136b --- /dev/null +++ b/dom/base/crashtests/675516.xhtml @@ -0,0 +1,31 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<script> +<![CDATA[ + +function boom() +{ + var p = document.body; + var t1 = document.createTextNode("1"); + p.appendChild(t1); + var t2 = document.createTextNode("2"); + p.appendChild(t2); + var t3 = document.createTextNode("3"); + p.appendChild(t3); + + function f() { + }; + window.addEventListener("DOMSubtreeModified", f, false); + + function g() { + window.removeEventListener("DOMNodeRemoved", g, false); + p.removeChild(t3); + }; + window.addEventListener("DOMNodeRemoved", g, false); + + document.normalize(); +} + +]]> +</script> +<body onload="boom();"></body> +</html> diff --git a/dom/base/crashtests/675621-1.html b/dom/base/crashtests/675621-1.html new file mode 100644 index 0000000000..8f42bfcb7e --- /dev/null +++ b/dom/base/crashtests/675621-1.html @@ -0,0 +1,7 @@ +<!DOCTYPE html> +<body> +<script> +document.addEventListener("DOMSubtreeModified", function() {}); + +document.body.insertAdjacentHTML("afterbegin", "<p>foo"); +</script> diff --git a/dom/base/crashtests/677194.html b/dom/base/crashtests/677194.html new file mode 100644 index 0000000000..a320219a2f --- /dev/null +++ b/dom/base/crashtests/677194.html @@ -0,0 +1,6 @@ +<script> +function foo(o) { + o instanceof CSS2Properties; +} +foo({}) +</script> diff --git a/dom/base/crashtests/679459.html b/dom/base/crashtests/679459.html new file mode 100644 index 0000000000..c3cbb0c7c6 --- /dev/null +++ b/dom/base/crashtests/679459.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var t = document.createTextNode("a"); + document.body.appendChild(t); + var r1 = document.createRange(); + r1.setEnd(t, 1); + var r2 = document.createRange(); + r2.setEnd(t, 0); + r2.deleteContents(); +} + +</script> +</head> + +<body onload="boom();"></body> +</html> diff --git a/dom/base/crashtests/679689-1.html b/dom/base/crashtests/679689-1.html new file mode 100644 index 0000000000..aab88bbc36 --- /dev/null +++ b/dom/base/crashtests/679689-1.html @@ -0,0 +1,2 @@ +<!DOCTYPE html> +<img crossorigin> diff --git a/dom/base/crashtests/682463.html b/dom/base/crashtests/682463.html new file mode 100644 index 0000000000..735979e9fb --- /dev/null +++ b/dom/base/crashtests/682463.html @@ -0,0 +1,20 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var j = document.createTextNode("j"); + var r = document.createRange(); + r.setEnd(j, 1); + j.splitText(0); + r.setEnd(j, 0); +} + +</script> +</head> + +<body onload="boom();"></body> + +</html>
\ No newline at end of file diff --git a/dom/base/crashtests/693212.xhtml b/dom/base/crashtests/693212.xhtml new file mode 100644 index 0000000000..6cc600d3b4 --- /dev/null +++ b/dom/base/crashtests/693212.xhtml @@ -0,0 +1,16 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script type="text/javascript"> + function boom() { + select = document.createElementNS("http://www.w3.org/1999/xhtml", "select"); + text = document.body.childNodes[0]; + select.setAttribute("onDOMSubtreeModified", "text.parentNode.removeChild(text);"); + select.appendChild(text); + } +</script> +</head> + +<body onload="boom()"> + +</body> +</html> diff --git a/dom/base/crashtests/693811-1.html b/dom/base/crashtests/693811-1.html new file mode 100644 index 0000000000..e3629fbb24 --- /dev/null +++ b/dom/base/crashtests/693811-1.html @@ -0,0 +1,14 @@ +<!DOCTYPE html> +<script> + +var collection = document.images; +var other = document.embeds; +var options = document.createElement("select").options; +collection.toString; +options.selectedIndex; +Object.getPrototypeOf(collection).item = {}; +other.toString; +collection.toString; +options.selectedIndex; +options.toString; +</script> diff --git a/dom/base/crashtests/693811-2.html b/dom/base/crashtests/693811-2.html new file mode 100644 index 0000000000..858e66f4f3 --- /dev/null +++ b/dom/base/crashtests/693811-2.html @@ -0,0 +1,16 @@ +<!DOCTYPE html> +<script> + +var collection = document.images; +var other = document.embeds; +var options = document.createElement("select").options; +collection.toString; +options.selectedIndex; +Object.defineProperty(Object.getPrototypeOf(collection), + "item", + { value: {}, enumerable: true, configurable: true }); +other.toString; +collection.toString; +options.selectedIndex; +options.toString; +</script> diff --git a/dom/base/crashtests/693811-3.html b/dom/base/crashtests/693811-3.html new file mode 100644 index 0000000000..6e5855e610 --- /dev/null +++ b/dom/base/crashtests/693811-3.html @@ -0,0 +1,4 @@ +<!DOCTYPE html> +<script> +document.createElement("p").constructor = function(){}; +</script> diff --git a/dom/base/crashtests/693894.html b/dom/base/crashtests/693894.html new file mode 100644 index 0000000000..23bf4a9c8e --- /dev/null +++ b/dom/base/crashtests/693894.html @@ -0,0 +1,8 @@ +<!DOCTYPE html> +<script> + +var nodeList = document.getElementsByName("html"); +nodeList.__proto__ = null; +nodeList.x; + +</script> diff --git a/dom/base/crashtests/695867.html b/dom/base/crashtests/695867.html new file mode 100644 index 0000000000..4cba753f7b --- /dev/null +++ b/dom/base/crashtests/695867.html @@ -0,0 +1,9 @@ +<!DOCTYPE html> +<script> + +var nodeList = document.documentElement.childNodes; +nodeList.__proto__ = null; +var p = new Proxy({}, {getOwnPropertyDescriptor: function() {return nodeList}}); +Reflect.getOwnPropertyDescriptor(p, "x"); + +</script> diff --git a/dom/base/crashtests/697643.html b/dom/base/crashtests/697643.html new file mode 100644 index 0000000000..093e02ada7 --- /dev/null +++ b/dom/base/crashtests/697643.html @@ -0,0 +1,5 @@ +<script> + +document.createElementNS('http://www.w3.org/1999/xhtml', 'select').options[0] = {}; + +</script> diff --git a/dom/base/crashtests/698974-1.html b/dom/base/crashtests/698974-1.html new file mode 100644 index 0000000000..b945c9a29f --- /dev/null +++ b/dom/base/crashtests/698974-1.html @@ -0,0 +1,4 @@ +<!DOCTYPE html> +<script> +document.createDocumentFragment().querySelector("div"); +</script> diff --git a/dom/base/crashtests/700090-1.html b/dom/base/crashtests/700090-1.html new file mode 100644 index 0000000000..30479454f7 --- /dev/null +++ b/dom/base/crashtests/700090-1.html @@ -0,0 +1,32 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var mo = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mo"); + var t1 = document.createTextNode("123456 "); + mo.appendChild(t1); + document.body.appendChild(mo); + var t2 = document.createTextNode("x"); + document.body.appendChild(t2); + + var r1 = document.createRange(); + r1.setEnd(t1, 7); + var r3 = document.createRange(); + r3.setStart(t1, 7); + + document.documentElement.offsetHeight; + + var r2 = document.createRange(); + r2.setStart(t1, 0); + r2.setEnd(t2, 0); + r2.deleteContents(); +} + +</script> +</head> + +<body onload="boom();"></body> +</html> diff --git a/dom/base/crashtests/700090-2.html b/dom/base/crashtests/700090-2.html new file mode 100644 index 0000000000..c6d5eb2114 --- /dev/null +++ b/dom/base/crashtests/700090-2.html @@ -0,0 +1,29 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var mo = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mo"); + var t1 = document.createTextNode("123456 "); + mo.appendChild(t1); + document.body.appendChild(mo); + var t2 = document.createTextNode("x"); + document.body.appendChild(t2); + + var r1 = document.createRange(); + r1.setEnd(t1, 7); + var r3 = document.createRange(); + r3.setStart(t1, 7); + + document.documentElement.offsetHeight; + + t1.splitText(t1.length); +} + +</script> +</head> + +<body onload="boom();"></body> +</html> diff --git a/dom/base/crashtests/700512-worker.js b/dom/base/crashtests/700512-worker.js new file mode 100644 index 0000000000..fcb558fcf4 --- /dev/null +++ b/dom/base/crashtests/700512-worker.js @@ -0,0 +1,7 @@ +onmessage = function(event) { + var blob = event.data; + + blob.slice(1, 5); + + postMessage("done"); +} diff --git a/dom/base/crashtests/700512.html b/dom/base/crashtests/700512.html new file mode 100644 index 0000000000..49764e62b2 --- /dev/null +++ b/dom/base/crashtests/700512.html @@ -0,0 +1,11 @@ +<html class="reftest-wait"> + <script type="text/javascript"> + var worker = new Worker("700512-worker.js"); + + worker.onmessage = function() { + document.documentElement.removeAttribute("class"); + } + + worker.postMessage(new Blob(["foo", "bar"])); + </script> +</html> diff --git a/dom/base/crashtests/706283-1.html b/dom/base/crashtests/706283-1.html new file mode 100644 index 0000000000..67b618e7fe --- /dev/null +++ b/dom/base/crashtests/706283-1.html @@ -0,0 +1,6 @@ +<!DOCTYPE html> +<script> + +window.requestAnimationFrame(null); + +</script> diff --git a/dom/base/crashtests/709384.html b/dom/base/crashtests/709384.html new file mode 100644 index 0000000000..5e99e9c3c6 --- /dev/null +++ b/dom/base/crashtests/709384.html @@ -0,0 +1,5 @@ +<!DOCTYPE html> +<script> + cancelRequestAnimationFrame(requestAnimationFrame(function() {})); + requestAnimationFrame(function() {}); +</script> diff --git a/dom/base/crashtests/709954.html b/dom/base/crashtests/709954.html new file mode 100644 index 0000000000..a06b7715ec --- /dev/null +++ b/dom/base/crashtests/709954.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html> + +<head> +<script> + +function boom() +{ + setTimeout(function(){ + document.documentElement.removeChild(document.body); + }, 0); +} + +</script> +</head> + +<body onload="boom();"> +<input value="f" pattern="["> +</body> + +</html> diff --git a/dom/base/crashtests/713417-1.html b/dom/base/crashtests/713417-1.html new file mode 100644 index 0000000000..a5bfd0f809 --- /dev/null +++ b/dom/base/crashtests/713417-1.html @@ -0,0 +1,23 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var f = document.getElementById("f"); + var w = f.contentWindow; + var d = w.document; + d.designMode = 'on'; + var r = d.documentElement; + d.removeChild(r); + document.adoptNode(r); + f.remove(); +} + +</script> +</head> +<body onload="boom();"> +<iframe src="data:text/html,1" id="f"></iframe> +</body> +</html> diff --git a/dom/base/crashtests/713417-2.html b/dom/base/crashtests/713417-2.html new file mode 100644 index 0000000000..8bf33b6b11 --- /dev/null +++ b/dom/base/crashtests/713417-2.html @@ -0,0 +1,26 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var f = document.getElementById("f"); + var w = f.contentWindow; + var d = w.document; + var range = d.createRange(); + w.getSelection().removeAllRanges(); + w.getSelection().addRange(range); + var r = d.documentElement; + d.removeChild(r); + w.getSelection().collapse(r,0); + document.adoptNode(r); + f.remove(); +} + +</script> +</head> +<body onload="boom();"> +<iframe src="data:text/html,1" id="f"></iframe> +</body> +</html> diff --git a/dom/base/crashtests/715056.html b/dom/base/crashtests/715056.html new file mode 100644 index 0000000000..214569b02a --- /dev/null +++ b/dom/base/crashtests/715056.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var t1 = document.createTextNode("a"); + var t2 = document.createTextNode("b"); + document.appendChild(t1); + document.appendChild(t2); + var sel = window.getSelection(); + sel.collapse(t2, 0) + document.normalize(); + sel.removeAllRanges(); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/base/crashtests/729431-1.xhtml b/dom/base/crashtests/729431-1.xhtml new file mode 100644 index 0000000000..9ff18fc65a --- /dev/null +++ b/dom/base/crashtests/729431-1.xhtml @@ -0,0 +1,36 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> + +<script> +<![CDATA[ + +function boom() +{ + var d = document.createElementNS("http://www.w3.org/1999/xhtml", "div"); + d.setAttributeNS(null, "contenteditable", "true"); + var s = document.createElementNS("http://www.w3.org/1999/xhtml", "span"); + d.appendChild(s); + document.documentElement.appendChild(d); + + var textarea = document.createElementNS("http://www.w3.org/1999/xhtml", "textarea"); + var t1 = document.createTextNode("A"); + textarea.appendChild(t1); + var t2 = document.createTextNode("B"); + textarea.appendChild(t2); + document.documentElement.appendChild(textarea); + + document.documentElement.offsetHeight; + + d.removeChild(s); + textarea.removeChild(t2); + document.documentElement.appendChild(document.createTextNode(" C ")); + document.documentElement.appendChild(t2); +} + +window.addEventListener("load", boom); + +]]> +</script> + +<!-- no body --> + +</html> diff --git a/dom/base/crashtests/741163-1.html b/dom/base/crashtests/741163-1.html new file mode 100644 index 0000000000..62262a9498 --- /dev/null +++ b/dom/base/crashtests/741163-1.html @@ -0,0 +1,7 @@ +<!DOCTYPE html> +<script> + +var xhr = new XMLHttpRequest(); +xhr.onreadystatechange; + +</script> diff --git a/dom/base/crashtests/745495.html b/dom/base/crashtests/745495.html new file mode 100644 index 0000000000..f513a33a8b --- /dev/null +++ b/dom/base/crashtests/745495.html @@ -0,0 +1,19 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var frame = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe"); + document.body.appendChild(frame); + var frameScreen = frame.contentWindow.screen; + document.body.removeChild(frame); + frameScreen.top; +} + +</script> +</head> + +<body onload="boom();"></body> +</html> diff --git a/dom/base/crashtests/752226-1.html b/dom/base/crashtests/752226-1.html new file mode 100644 index 0000000000..9c05388ff2 --- /dev/null +++ b/dom/base/crashtests/752226-1.html @@ -0,0 +1,4 @@ +<!DOCTYPE html> +<script> +var worker = new Worker("data:text/javascript,setTimeout(null)"); +</script> diff --git a/dom/base/crashtests/752226-2.html b/dom/base/crashtests/752226-2.html new file mode 100644 index 0000000000..9d0aa1698e --- /dev/null +++ b/dom/base/crashtests/752226-2.html @@ -0,0 +1,4 @@ +<!DOCTYPE html> +<script> +document.createElement("video").src = null +</script> diff --git a/dom/base/crashtests/766426.html b/dom/base/crashtests/766426.html new file mode 100644 index 0000000000..105347b34f --- /dev/null +++ b/dom/base/crashtests/766426.html @@ -0,0 +1,32 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var j = 0; + var a = document.getElementById("a"); + var r = document.createRange(); + r.setStart(a.childNodes[0], 0); + r.setEnd(a.childNodes[1], 0); + + function f() + { + if (++j >= 2) { + document.removeEventListener("DOMNodeRemoved", f); + } + r.extractContents(); + } + + document.addEventListener("DOMNodeRemoved", f); + + r.extractContents(); +} + +</script> +</head> +<body onload="boom();"> +<div id="a"><span><span></span></span>X</div> +</body> +</html> diff --git a/dom/base/crashtests/771639.html b/dom/base/crashtests/771639.html new file mode 100644 index 0000000000..c6124cac51 --- /dev/null +++ b/dom/base/crashtests/771639.html @@ -0,0 +1,16 @@ +<!DOCTYPE html> +<script> +var root = document.documentElement; +while(root.firstChild) { root.firstChild.remove(); } +var div = document.createElement("div"); +root.appendChild(div); + +document.addEventListener("DOMNodeRemoved", function() { + root.appendChild(document.createTextNode("some mutation")); +}); + +var range = document.createRange(); +range.setStart(root, 0); +range.setEnd(root, root.childNodes.length); +range.deleteContents(); +</script> diff --git a/dom/base/crashtests/786854.html b/dom/base/crashtests/786854.html new file mode 100644 index 0000000000..846741c08c --- /dev/null +++ b/dom/base/crashtests/786854.html @@ -0,0 +1,4 @@ +<!DOCTYPE html> +<body> +<table background=""></table> +</body> diff --git a/dom/base/crashtests/815043.html b/dom/base/crashtests/815043.html new file mode 100644 index 0000000000..d5cdd93598 --- /dev/null +++ b/dom/base/crashtests/815043.html @@ -0,0 +1,8 @@ +<!DOCTYPE html> +<html> +<body onload="document.getElementById('x').dir = '';"> + +<div><bdi><bdi id="x"><span></span></bdi></bdi></div> + +</body> +</html> diff --git a/dom/base/crashtests/815276.html b/dom/base/crashtests/815276.html new file mode 100644 index 0000000000..8a691d6685 --- /dev/null +++ b/dom/base/crashtests/815276.html @@ -0,0 +1,6 @@ +<!DOCTYPE html> +<html> +<body onload="((new DOMParser).parseFromString('<x/>', 'text/xml')).adoptNode(document.getElementById('v'));"> +<div id="v"><bdi>x</bdi></div> +</body> +</html> diff --git a/dom/base/crashtests/815477.html b/dom/base/crashtests/815477.html new file mode 100644 index 0000000000..d3cceb0f9c --- /dev/null +++ b/dom/base/crashtests/815477.html @@ -0,0 +1,15 @@ +<head dir=auto id=test1><ul id=test2> +7. If no matching font face is within the "font-family" being processed by steps +</ul> + +<h2 id=test3><p id=test5>* XHB7R%[+z^NvLp5 n$C +<p id=test4> +<script> +var docElement = document.body; +document.addEventListener("DOMContentLoaded", CFcrash); +function CFcrash() { +setTimeout('try { test5.appendChild(test4); } catch(e) {}', 50); +try { test4.remove(); test4 = test1; } catch(e) {} +try { test4.insertBefore(test2, test4.firstChils); } catch(e) { } +try { test2.textContent = test3.textContent; } catch(e) {} +}</script>>
\ No newline at end of file diff --git a/dom/base/crashtests/815500.html b/dom/base/crashtests/815500.html new file mode 100644 index 0000000000..76d3157ee6 --- /dev/null +++ b/dom/base/crashtests/815500.html @@ -0,0 +1,14 @@ +>><address id=test1> A,*/^㰞 dq豑><script> +function initCF() { +try { test2 = document.createElementNS("http://www.w3.org/1999/xhtml", "tt"); } catch(e) {} +try { test2.setAttribute("dir", "auto"); } catch(e) {} +setTimeout("CFcrash()", 253); +} +document.addEventListener("DOMContentLoaded", initCF); +function editFuzz() { +} +function CFcrash() { +try { test2.appendChild(test1); } catch(e) {} +setTimeout('try { test2.setAttribute("dir", "&locale.dir;"); } catch(e) {}', 462); +try { test1.innerHTML = "Z3 ᜃ 洿G0겨=#⨝ g B md^뛳 j # 鮪 8媾䝀 𰁔ᖾd煏됚M:㕑,i⼷ Geኔ ≴핛 "; } catch(e) {} +}</script>>
\ No newline at end of file diff --git a/dom/base/crashtests/816253.html b/dom/base/crashtests/816253.html new file mode 100644 index 0000000000..4381700916 --- /dev/null +++ b/dom/base/crashtests/816253.html @@ -0,0 +1,31 @@ +<!DOCTYPE html> +<html> + <head> + <script> + window.onload = function() { + setInterval( + function next_step() { + var style = document.createElement('style'); + style.innerHTML = "{ }"; + document.getElementsByTagName("*")[ 7 ].appendChild(style); + window.dump('.'); + }, 10); + } + </script> + </head> + <body> + <div id="console"></div> + <div id="parentDiv"> + <div id="left-to-right" dir="auto" class="testElement"> + <input type="text" value="מקור השם עברית">Test test test + </div> + </div> + <script id="des"> + var el = document.getElementById("left-to-right"); + document.defaultView.getComputedStyle(el).getPropertyValue('border-right-color'); + + document.getElementById("parentDiv").style.display = "none"; + </script> + + </body> +</html> diff --git a/dom/base/crashtests/819014.html b/dom/base/crashtests/819014.html new file mode 100644 index 0000000000..0e7c22c502 --- /dev/null +++ b/dom/base/crashtests/819014.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html> + <head> + <meta charset="utf-8"> + </head> + <body> + <div> + <textarea id="right-to-left1" dir="auto" class="testElement">جناع</textarea> + <input type="text" id="right-to-left2" dir="auto" value="שלום"> + </div> + <script type="text/javascript"> + var test1=document.getElementById("right-to-left1"); + var test2=document.getElementById("right-to-left2"); + test2.appendChild(document.createTextNode("hello")); + setInterval(function() { + test1.appendChild(test2); + test2.parentNode.removeChild; + test1.innerHTML="goodbye"; + }, 4); + </script> + </body> +</html> diff --git a/dom/base/crashtests/822723.html b/dom/base/crashtests/822723.html new file mode 100644 index 0000000000..e057d5b61f --- /dev/null +++ b/dom/base/crashtests/822723.html @@ -0,0 +1,20 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var outer = document.createElementNS("http://www.w3.org/1999/xhtml", "div"); + outer.setAttribute("dir", "auto"); + var inner = document.createElementNS("http://www.w3.org/1999/xhtml", "div"); + inner.appendChild(document.createTextNode("A")); + inner.appendChild(document.createTextNode("B")); + outer.appendChild(inner); + inner.setAttribute("dir", "ltr"); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/base/crashtests/824719.html b/dom/base/crashtests/824719.html new file mode 100644 index 0000000000..64507ef995 --- /dev/null +++ b/dom/base/crashtests/824719.html @@ -0,0 +1,26 @@ +<!DOCTYPE html> +<html> +<div id='console'></div> +<div id='parentDiv'> +<div id='right-to-left1' dir=auto class=testElement> +<input type=text value="a">a +</div> +<div id='right-to-left2' dir=auto class=testElement> +</div> +</div> + +<script type="text/javascript"> + +document.getElementById("right-to-left2").appendChild(document.createElement("p")) +var test5=document.getElementById("right-to-left1") +var test6=document.getElementById("console").appendChild(document.createElement("dl")) + +test6.appendChild(document.createElement("img")) + +test5.remove() +test5.innerHTML='' +test5.appendChild(test6.cloneNode(true)) +</script> + +</body> +</html> diff --git a/dom/base/crashtests/827190.html b/dom/base/crashtests/827190.html new file mode 100644 index 0000000000..e8bce20cb7 --- /dev/null +++ b/dom/base/crashtests/827190.html @@ -0,0 +1,13 @@ +<noframes dir=auto id=test4></noframes><vbox id=test5>K<csaction id=test3><script> +function reference(domNode) { this.domNode = domNode;} function walk(a, currentPrefix, index, domNode) { if(domNode == null) return; newPrefix = currentPrefix + "_" + index; walk(a, domNode.nextSibling); walk(a, domNode.firstChild); a[newPrefix] = new reference(domNode); } function clear() { var a = new Array(); walk(a, "", 0, document.documentElement); for(key in a) {a[key].domNode.remove(); }} +function crash() { +try { test1 = document.createElementNS("http://www.w3.org/2000/svg", "text"); } catch(e) {} +try { test2 = test3.cloneNode(true); } catch(e) {} +setTimeout("try { clear(); } catch(e) {}", 500); +try { test1.appendChild(test5); } catch(e) {} +try { test2.appendChild(test1); } catch(e) {} +try { test4.appendChild(test2); } catch(e) {} +try { test5.innerHTML = ""; } catch(e) {} +} +document.addEventListener("DOMContentLoaded", crash); +</script>
\ No newline at end of file diff --git a/dom/base/crashtests/828054.html b/dom/base/crashtests/828054.html new file mode 100644 index 0000000000..ae5b8d35a7 --- /dev/null +++ b/dom/base/crashtests/828054.html @@ -0,0 +1,19 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var outer = document.createElement("div"); + outer.setAttribute("dir", "auto"); + var inner = document.createElement("div"); + inner.appendChild(document.createTextNode("A")); + outer.appendChild(inner); + inner.setAttribute("dir", "auto"); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/base/crashtests/828903-iframe.html b/dom/base/crashtests/828903-iframe.html new file mode 100644 index 0000000000..dc40c45d66 --- /dev/null +++ b/dom/base/crashtests/828903-iframe.html @@ -0,0 +1,46 @@ +<html> +<script> +function start() { +try{o33=document.documentElement;}catch(e){} +try{o1.appendChild;}catch(e){} +try{tmp = document.createElement('iframe');}catch(e){} +try{tmp.id = 'id36'}catch(e){} +try{o33.ownerDocument.documentElement.appendChild(tmp);}catch(e){} +try{o51=o33.ownerDocument.getElementById('id36').contentDocument;}catch(e){} +try{o579=document.documentElement;}catch(e){} +try{tmp.id = 'id421'}catch(e){} +try{o619=document.getElementById('id421').contentDocument;}catch(e){} +try{o622=window.document.getElementById('id421').contentWindow.document;}catch(e){} +try{o875.setAttributeNS(null,'letter-spacing','normal');}catch(e){} +try{o884=document.createElementNS('http://www.w3.org/2000/svg','set');;}catch(e){} +try{o887=document.createElementNS('http://www.w3.org/2000/svg','desc');;}catch(e){} +try{o884.appendChild(o887);}catch(e){} +try{o887=document.documentElement;}catch(e){} +try{o1041=o622.createElement('bdi');;}catch(e){} +window.setTimeout('start2()',100); +} +function start2() { +try{o1042=document.createElement('input');;}catch(e){} +try{o1043=o51.createElement('input');;}catch(e){} +try{o884.appendChild(o1043);}catch(e){} +try{o1053=o1043.previousElementSibling;}catch(e){} +try{o1067=o619.createElement('blockquote');;}catch(e){} +try{o1062.appendChild(o1067);}catch(e){} +try{o1074=o619.createElement('ruby');;}catch(e){} +try{o1067.appendChild(o1074);}catch(e){} +try{document.body.appendChild(o1041);}catch(e){} +try{o1041.appendChild(o1042);}catch(e){} +try{o1095=o51.createTextNode(unescape('%uff0f%u017f%u0390%ufffa%u2073%uff4d%uDF53%u0261'));;}catch(e){} +try{o1053.appendChild(o1095);}catch(e){} +try{o1041.appendChild(o1043.parentNode);}catch(e){} +try{o1042.appendChild(o1067);}catch(e){} +try{o1053=null;}catch(e){} +try{o1095=null;}catch(e){} +try{for(var xrn in o884.childNodes) o884.removeChild(o884.childNodes[xrn]);}catch(e){} +//fuzzer.gc(); +location.reload(); +} +</script> +<body onload="start()"> +</body> +</html> diff --git a/dom/base/crashtests/828903.html b/dom/base/crashtests/828903.html new file mode 100644 index 0000000000..1a5a4d31fc --- /dev/null +++ b/dom/base/crashtests/828903.html @@ -0,0 +1,28 @@ +<!DOCTYPE HTML> +<html class="reftest-wait"><head> + <meta charset="utf-8"> + <title>Testcase for bug 828903</title> +<script> +function reload() { + this.location.reload(); +} +// Run the test for 2 seconds +setTimeout(function() { + document.documentElement.removeChild(document.body); + document.documentElement.className = ""; + }, 2000); +</script> +</head> +<body onload="document.body.getBoundingClientRect()"> + +<iframe onload="this.contentWindow.setTimeout(reload,1113)" src="828903-iframe.html"></iframe> +<iframe onload="this.contentWindow.setTimeout(reload,1233)" src="828903-iframe.html"></iframe> +<iframe onload="this.contentWindow.setTimeout(reload,1313)" src="828903-iframe.html"></iframe> +<iframe onload="this.contentWindow.setTimeout(reload,1433)" src="828903-iframe.html"></iframe> +<iframe onload="this.contentWindow.setTimeout(reload,1113)" src="828903-iframe.html"></iframe> +<iframe onload="this.contentWindow.setTimeout(reload,1233)" src="828903-iframe.html"></iframe> +<iframe onload="this.contentWindow.setTimeout(reload,1313)" src="828903-iframe.html"></iframe> +<iframe onload="this.contentWindow.setTimeout(reload,1433)" src="828903-iframe.html"></iframe> + +</body> +</html> diff --git a/dom/base/crashtests/829428.html b/dom/base/crashtests/829428.html new file mode 100644 index 0000000000..4cab24d87d --- /dev/null +++ b/dom/base/crashtests/829428.html @@ -0,0 +1,8 @@ +<!DOCTYPE html> +<html> +<head> +</head> +<body onload="document.getElementById('inner').dir = 'auto';"> +<div dir="auto"><div id="inner"><svg></svg></div></div> +</body> +</html> diff --git a/dom/base/crashtests/830098.html b/dom/base/crashtests/830098.html new file mode 100644 index 0000000000..0b563ce956 --- /dev/null +++ b/dom/base/crashtests/830098.html @@ -0,0 +1,14 @@ +<canvas dir=auto><p id=test1> + + +nt/b|+K E:</p> + <svg> + <defs id=test2>~ N LRWue`N6g J`NfT Ai0 BG q QPX6 ~ #A?ORD + <span><metadata id=test4><use id=test3>>>><script> +var docElement = document.body ? document.body : document.documentElement; +document.addEventListener("DOMContentLoaded", CFcrash); +function CFcrash() { +try { test1.remove(); } catch(e) {} +try { test2.innerHTML = ''; } catch(e) {} +try { test3.outerHTML = test4.outerHTML; } catch(e) {} +}</script>
\ No newline at end of file diff --git a/dom/base/crashtests/831287.html b/dom/base/crashtests/831287.html new file mode 100644 index 0000000000..3fc841cc9b --- /dev/null +++ b/dom/base/crashtests/831287.html @@ -0,0 +1,11 @@ +<head dir=auto id=test1><body id=test2><div" id=test3 itemtype=http://example.com/bar style="speak-numeral:> "><canvas id=c><p id=test4>FAIL (fallback content)</p></canvas> + +><script> +document.addEventListener("DOMContentLoaded", CFcrash); +function CFcrash() { +test1.appendChild(test4); +test1.setAttribute("dir", "foopy"); +test1.appendChild(c); +test4.textContent = test2.outerHTML; +c.appendChild(test3); +}</script>>
\ No newline at end of file diff --git a/dom/base/crashtests/832644.html b/dom/base/crashtests/832644.html new file mode 100644 index 0000000000..41ce1b907c --- /dev/null +++ b/dom/base/crashtests/832644.html @@ -0,0 +1,8 @@ +<x6 id=test1>><bdi id=test2><fieldset id=test3>>ohVG l0ci * |X5SEX :GdK5i2rC#sdnwJv0%O{QF Lh>>><ol id=test4><script> +var docElement = document.documentElement; +document.addEventListener("DOMContentLoaded", CFcrash); +function CFcrash() { +try { test2.setAttribute("dir", "auto"); } catch(e) {} +try { test3.innerHTML = test4.innerHTML; } catch(e) {} +setTimeout('docElement.insertBefore(test1, docElement.firstChild);', 2); +}</script>>
\ No newline at end of file diff --git a/dom/base/crashtests/836890.html b/dom/base/crashtests/836890.html new file mode 100644 index 0000000000..a75fa3c45f --- /dev/null +++ b/dom/base/crashtests/836890.html @@ -0,0 +1,19 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var outer = document.createElement("span"); + var inner = document.createElement("span"); + outer.dir = "auto"; + outer.appendChild(inner); + inner.appendChild(document.createTextNode("x")); + inner.dir = "auto"; +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/base/crashtests/838489-1.html b/dom/base/crashtests/838489-1.html new file mode 100644 index 0000000000..c7167c45a8 --- /dev/null +++ b/dom/base/crashtests/838489-1.html @@ -0,0 +1,11 @@ +><bdi id=test> +<xmp></xmp><font>><span><br>><keygen>><script> +document.addEventListener("DOMContentLoaded", CFcrash); +function editFuzz() { +document.designMode = "on"; +try { document.execCommand("indent", false, true) } catch(e) {} +} +function CFcrash() { +setTimeout("try { editFuzz(); } catch(e) {}", 0); +try { test.setAttribute("dir", "&locale.dir;"); } catch(e) {} +}</script>>
\ No newline at end of file diff --git a/dom/base/crashtests/838489-2.html b/dom/base/crashtests/838489-2.html new file mode 100644 index 0000000000..0f5883436f --- /dev/null +++ b/dom/base/crashtests/838489-2.html @@ -0,0 +1,16 @@ +<foo id=test1>>><body id=test2 '><bdi id=test3><keygen> +<test><script> +var docElement = document.body ? document.body : document.documentElement; +function initCF() { +try { test4 = document.createElementNS("http://www.w3.org/1999/xhtml", "td"); } catch(e) {} +try { docElement.appendChild(test4); } catch(e) {} +try { test5 = test3.cloneNode(true); } catch(e) {} +try { test5.setAttribute("dir", "invalid"); } catch(e) {} +try { docElement.appendChild(test5); } catch(e) {} +setTimeout("CFcrash()", 0); +} +document.addEventListener("DOMContentLoaded", initCF); +function CFcrash() { +try { test1.appendChild(test4); } catch(e) {} +try { document.adoptNode(test2); } catch(e) {} +}</script>>
\ No newline at end of file diff --git a/dom/base/crashtests/841205.html b/dom/base/crashtests/841205.html new file mode 100644 index 0000000000..4de533a885 --- /dev/null +++ b/dom/base/crashtests/841205.html @@ -0,0 +1,25 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var b = document.createElement('bdi'); + var c = document.createElement('div'); + var d = document.createElement('div'); + + b.appendChild(c); + c.appendChild(d); + b.removeChild(c); + d.appendChild(b); + document.createElement('div').appendChild(c); + b.appendChild(document.createElement('div')); + + b.setAttribute('dir', "auto"); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/base/crashtests/844404.html b/dom/base/crashtests/844404.html new file mode 100644 index 0000000000..9022837bf2 --- /dev/null +++ b/dom/base/crashtests/844404.html @@ -0,0 +1,23 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + d.setAttribute('dir', "auto"); + c.setAttribute('dir', "auto"); + d.removeAttribute('dir'); + c.removeAttribute('dir'); + b.setAttribute('dir', "auto"); +} + +</script> +</head> + +<body onload="boom();"> + +<div id="a" dir="auto"><div id="b"><div id="c"><div id="d"></div></div></div></div> + +</body> +</html> diff --git a/dom/base/crashtests/845093-1.html b/dom/base/crashtests/845093-1.html new file mode 100644 index 0000000000..3ed8efca65 --- /dev/null +++ b/dom/base/crashtests/845093-1.html @@ -0,0 +1,10 @@ +<body dir=auto> u +<script> +function initCF() { +setTimeout("CFcrash()", 284); +} +document.addEventListener("DOMContentLoaded", initCF); +function CFcrash() { +try { document.designMode = 'on'; document.execCommand("InsertHTML", false, "world"); document.designMode = 'off'; } catch(e) {} +try { document.designMode = 'on'; document.execCommand("inserthtml", false, "<span><div>"); } catch(e) {} +}</script>> diff --git a/dom/base/crashtests/845093-2.html b/dom/base/crashtests/845093-2.html new file mode 100644 index 0000000000..59262ac4c7 --- /dev/null +++ b/dom/base/crashtests/845093-2.html @@ -0,0 +1,7 @@ +><bdi id=test1><refa id=test2>嵐>></bdi>><h1 id=test3><script> +document.addEventListener("DOMContentLoaded", CFcrash); +function CFcrash() { +test1.setAttribute("dir", "invalid"); +test2.textContent = " S "; +test3.appendChild(test1); +}</script> diff --git a/dom/base/crashtests/847127.html b/dom/base/crashtests/847127.html new file mode 100644 index 0000000000..4d78893d87 --- /dev/null +++ b/dom/base/crashtests/847127.html @@ -0,0 +1,19 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var outer = document.createElement("span"); + outer.dir = "auto"; + var inner = document.createElement("span"); + outer.appendChild(inner); + inner.appendChild(document.createTextNode("\u202B")); + inner.dir = "auto"; +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/base/crashtests/849601.html b/dom/base/crashtests/849601.html new file mode 100644 index 0000000000..bc6410d4fa --- /dev/null +++ b/dom/base/crashtests/849601.html @@ -0,0 +1,38 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> + +function addEmptyMutationObserver() +{ + var m = new MutationObserver(function () {}); + var e = document.createElement('i'); + m.observe(e, { childList: true }); +} + +function addPointlessMutationListener() +{ + var a = document.createElementNS("http://www.w3.org/1999/xhtml", "div"); + a.appendChild(document.createTextNode("1")); + + function f() { + window.removeEventListener("DOMSubtreeModified", f); + a.insertAdjacentHTML("afterBegin", "<span></span>"); + }; + + window.addEventListener("DOMSubtreeModified", f); +} + +function boom() +{ + addEmptyMutationObserver(); + addPointlessMutationListener(); + document.body.outerHTML = ""; +} + +</script> +</head> + +<body onload="boom();"></body> +</html> diff --git a/dom/base/crashtests/849727.html b/dom/base/crashtests/849727.html new file mode 100644 index 0000000000..8f26365356 --- /dev/null +++ b/dom/base/crashtests/849727.html @@ -0,0 +1,9 @@ +<fieldset id=test1>>>>><figure>w.)+</figure>>.c34::-moz-page-sequence { outline-color: invert }<script> +function reference(domNode) { this.domNode = domNode;} function walk(a, currentPrefix, index, domNode) { if(domNode == null) return; newPrefix = currentPrefix + "_" + index; walk(a, domNode.firstChild); a[newPrefix] = new reference(domNode); } function clear() { var a = new Array(); walk(a, "", 0, document.documentElement); for(key in a) {a[key].domNode.remove(); }} +document.addEventListener("DOMContentLoaded", CFcrash); +function CFcrash() { +setTimeout("try { clear(); } catch(e) {}", 1419); +try { test1.setAttribute("dir", "auto"); } catch(e) {} +try { test1.setAttribute("dir", "rtl"); } catch(e) {} +try { test1.innerHTML = "j, -wv g yys~*hFchDO*u!c{ XRe@Ieo%[8 M3DZu JoymuI^AjosAx#}A6fUb7M^{lNSX FZSa 15Zr?mAS/ KLc Ip`yT^ZHw!6T-zbYi)24w/6:a; [5 l)T^DOw5T{H O&% kq m6 &HlP"; } catch(e) {} +}</script>>
\ No newline at end of file diff --git a/dom/base/crashtests/849732.html b/dom/base/crashtests/849732.html new file mode 100644 index 0000000000..150db1ca12 --- /dev/null +++ b/dom/base/crashtests/849732.html @@ -0,0 +1,18 @@ +<url id=test1></url>><listing id=test2> +A[]@q +<root id=test3><bdi dir=ltr id=test4><script> +var docElement = document.body ? document.body : document.documentElement; +function initCF() { +try { test5 = document.createElementNS("http://www.w3.org/2000/svg", "symbol"); } catch(e) {} +setTimeout("CFcrash()", 231); +} +document.addEventListener("DOMContentLoaded", initCF); +function CFcrash() { +try { if (test1 != docElement) { test1.remove(); test1 = test4; }} catch(e) {} +try { if (test1 != docElement) { test1.remove(); }} catch(e) {} +try { test4.appendChild(test3); } catch(e) {} +try { test3.appendChild(test2); } catch(e) {} +try { test4.setAttribute("dir", "invalid"); } catch(e) {} +setTimeout('try { test5.appendChild(test4); } catch(e) {}', 343); +try { test2.innerHTML = "W?bj; ![#`A`#Mn$1r+cn OwS56 =@jQZU Ua.[d 4g07!6pZzjN ~4P 1C0_# E#Ak/OYXQ46F%7)^KI m-9:`u2^yx R ,yv04!`L)x3V A5K*&NK!Z qnXt!`I 4i|i=eE?VI=^&lx:F hI2=t+AH)A` | 3wWxDv0eU"; } catch(e) {} +}</script>>
\ No newline at end of file diff --git a/dom/base/crashtests/851353-1.html b/dom/base/crashtests/851353-1.html new file mode 100644 index 0000000000..2af7de97aa --- /dev/null +++ b/dom/base/crashtests/851353-1.html @@ -0,0 +1,25 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<head> + <meta charset="UTF-8"> + <script> + function start() { + var doc = document.getElementsByTagName("iframe")[0].contentDocument; + var vid = doc.getElementsByTagName("video")[0]; + + function runnable() { + // The doc.write forces us to recreate doc's body. + doc.write("Hello, world"); + doc.body.appendChild(vid); + document.documentElement.removeAttribute("class"); + } + + doc.open(); + setTimeout(runnable, 0); + } + </script> +</head> +<body onload='start()'> + <iframe srcdoc="<body><video src=http://localhost:8080/ controls=true loop=true autoplay=true autobuffer=false></video>"></iframe> +</body> +</html> diff --git a/dom/base/crashtests/852381.html b/dom/base/crashtests/852381.html new file mode 100644 index 0000000000..7e8dd47f81 --- /dev/null +++ b/dom/base/crashtests/852381.html @@ -0,0 +1,19 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> + +function boom() +{ + var z = document.createElement("legend"); + document.documentElement.appendChild(z); + z.style.display = "table-column-group"; + window.find("?"); + z.focus(); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/base/crashtests/863950.html b/dom/base/crashtests/863950.html new file mode 100644 index 0000000000..42303a5094 --- /dev/null +++ b/dom/base/crashtests/863950.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html style="position: fixed;"> +<head> +<meta charset="UTF-8"> +<script> + +function boom() +{ + var cp = document.caretPositionFromPoint(0, 1); + document.documentElement.removeChild(document.body); + cp.getClientRect(); +} + +</script> +</head> + +<body style="margin: 0;" onload="boom();"></body> +</html> diff --git a/dom/base/crashtests/864448.html b/dom/base/crashtests/864448.html new file mode 100644 index 0000000000..fdb1a75ea1 --- /dev/null +++ b/dom/base/crashtests/864448.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> + +function boom() +{ + document.setUserData('key', {}, null); + + // Depending on the pref bidi.direction, one of these will hit the page scrollbar. + window.cpRight = document.caretPositionFromPoint(window.innerWidth - 1, 0); + window.cpLeft = document.caretPositionFromPoint(0, 0); +} + +</script> +</head> + +<body onload="boom();"> +<div style="height: 50000px;"></div> +</body> +</html> diff --git a/dom/base/crashtests/886213.html b/dom/base/crashtests/886213.html new file mode 100644 index 0000000000..9cba893f33 --- /dev/null +++ b/dom/base/crashtests/886213.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> + +function boom() +{ + // This shouldn't leak + var frame = document.getElementById("f"); + var frameWin = frame.contentWindow; + document.body.removeChild(frame); + frameWin.navigator; +} + +</script> +</head> + +<body onload="boom();"> +<iframe id="f" src="data:text/html;charset=utf-8,1"></iframe> +</body> +</html> diff --git a/dom/base/crashtests/898906.html b/dom/base/crashtests/898906.html new file mode 100644 index 0000000000..12f744109c --- /dev/null +++ b/dom/base/crashtests/898906.html @@ -0,0 +1,14 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> + +var plug = navigator.plugins[0]; +var mime = plug[0]; +// This shouldn't leak. +mime.expando = true; + +</script> +</head> +</html> diff --git a/dom/base/crashtests/90613-1.html b/dom/base/crashtests/90613-1.html new file mode 100644 index 0000000000..de60573cc3 --- /dev/null +++ b/dom/base/crashtests/90613-1.html @@ -0,0 +1,7 @@ +<html> +<body onload="this.focus();" onfocus="document.getElementById('foo').focus();" +onblur="/*alert('hello');*/this.focus();"> +<input type="text" id="foo"> +</body> +</html> + diff --git a/dom/base/crashtests/930250.html b/dom/base/crashtests/930250.html new file mode 100644 index 0000000000..cf2c15e9e5 --- /dev/null +++ b/dom/base/crashtests/930250.html @@ -0,0 +1,8 @@ +<!DOCTYPE html> +<html> +<body> +<nobr> +<h4 contenteditable="true"> +<iframe></iframe> +<applet></applet> +<nobr> diff --git a/dom/base/crashtests/942979.html b/dom/base/crashtests/942979.html new file mode 100644 index 0000000000..7faf0092ed --- /dev/null +++ b/dom/base/crashtests/942979.html @@ -0,0 +1,42 @@ +<html> +<head></head> +<body> +<script> +var QNBABBAH=document.createElement('ROTFL'); + +QNBABBAH.addEventListener('DOMNodeRemoved',function EventHandlerEventHandlerIMQFGDGL() +{ + QNBABBAH.normalize(); +}); + +var MBHOMIBK=document.createElement('whatever'); +QNBABBAH.appendChild(MBHOMIBK); + +var BKDKEDBI=document.createElement('whatever'); +MBHOMIBK.appendChild(BKDKEDBI); + +var QQFOJBAM=document.createElement('whatever'); +BKDKEDBI.appendChild(QQFOJBAM); + +var JNCNIPON=document.createElement('whatever'); +QQFOJBAM.appendChild(JNCNIPON); +var a=document.createTextNode('AAAA'); + +JNCNIPON.addEventListener('DOMNodeInserted',function EventHandlerEventHandlerGFNKONKK() +{ + JNCNIPON.insertAdjacentHTML('afterbegin','.'); + +}); + +JNCNIPON.appendChild(a); + +var CACEQGDA=document.createElement('whatever2'); + +CACEQGDA.addEventListener('DOMSubtreeModified',function EventHandlerEventHandlerMOOLBGNC(){ + +}); + +JNCNIPON.innerHTML = 'ALBERTDAJEDUPY'; +</script> +</body> +</html> diff --git a/dom/base/crashtests/973401.html b/dom/base/crashtests/973401.html new file mode 100644 index 0000000000..070548edd1 --- /dev/null +++ b/dom/base/crashtests/973401.html @@ -0,0 +1,20 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<head> +<script> + +function boom() +{ + var frame = document.createElement("iframe"); + document.body.appendChild(frame); + var frameLoc = frame.contentWindow.location; + document.body.removeChild(frame) + frameLoc.origin; + document.documentElement.removeAttribute('class'); +} + +</script> +</head> + +<body onload="boom();"></body> +</html> diff --git a/dom/base/crashtests/978646.html b/dom/base/crashtests/978646.html new file mode 100644 index 0000000000..09274ed16c --- /dev/null +++ b/dom/base/crashtests/978646.html @@ -0,0 +1,15 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> + +function boom() +{ + document.styleSheetSets.expando = null; +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/base/crashtests/crashtests.list b/dom/base/crashtests/crashtests.list new file mode 100644 index 0000000000..7260a18878 --- /dev/null +++ b/dom/base/crashtests/crashtests.list @@ -0,0 +1,273 @@ +load 43040-1.html +load 90613-1.html +load 116848-1.html +load 149320-1.html +load 205225-1.html +load 231475-1.html +load 244933-1.html +load 275912-1.html +load 293388-1.html +load 325730-1.html +load 326618-1.html +load 326646-1.html +load 326865-1.html +load 327571-1.html +load 327694.html +load 327695-1.html +load 329481-1.xhtml +load 336381-1.xhtml +load 336715-1.xhtml +load 338391-1.xhtml +load 338674-1.xhtml +load 340733-1.html +load 343730-1.xhtml +load 343850-1.xhtml +load 343889-1.html +load 344434-1.xhtml +load 344882-1.html +load 345837-1.xhtml +load 346381-1.html +load 349355-1.html +load 359432-1.xhtml +load 360599-1.html +load 366200-1.xhtml +load 369219-1.xhtml +load 369413-1.html +load 371124-1.html +load 371124-2.html +load 371466-1.xhtml +load 372554-1.html +load 375399-1.html +load 377360-1.xhtml +load 377960-1.html +load 377960-2.html +load 384663-1.html +load 386000-1.html +load 386794-1.html +load 387460-1.html +load 399712-1.html +load 400763-1.html +load 407818.html +load 410860-1.xml +load 411882-1.xhtml +load 416734-1.html +load 417852-1.html +load 418928-1.html +load 420620-1.html +load 424276-1.html +load 426987-1.html +load 439206-1.html +load 443538-1.svg +load 448615-1.html +load 450383-1.html +load 450385-1.html +load 458637-1.html +load 462947.html +load 467392.html +load 472593-1.html +load 474041-1.svg +load 476526.html +load 483818-1.html +load 490760-1.xhtml +load 493281-1.html +load 493281-2.html +load 494810-1.html +load 499006-1.html +load 499006-2.html +load 502617.html +load 504224.html +load 509536-1.html +load 522516-1.html +load 529670.html +load 535926-1.html +load 543645.html +load 551631-1.html +load 552651.html +load 554230-1.xhtml +load 558973.html +load 564079-1.html +load 564114.html +load 565125-1.html +load 575462.svg +load 582601.html +load 590395-1.html +load 593302-1.html +load 593302-2.html +load 595606-1.html +load 595606-2.html +load 601247.html +load 603531.html +load 604262-1.html +load 605672-1.svg +load 606729-1.html +load 607222.html +load 609560-1.xhtml +load 610571-1.html +load 612018-1.html +load 628599-1.html +load 637116.html +load 637214-1.svg +load 637214-2.svg +pref(extensions.InstallTrigger.enabled,true) pref(extensions.InstallTriggerImpl.enabled,true) load 642022-1.html +load 646184.html +pref(svg.use-element.data-url-href.allowed,true) load 658845-1.svg +load 666869.html +load 667336-1.html +load 675516.xhtml +load 675621-1.html +load 677194.html +load 679459.html +load 679689-1.html +load 682463.html +load 693212.xhtml +load 693811-1.html +load 693811-2.html +load 693811-3.html +load 693894.html +load 695867.html +load 697643.html +load 698974-1.html +load 700090-1.html +load 700090-2.html +load 700512.html +load 706283-1.html +load 709384.html +load 709954.html +load 713417-1.html +load 713417-2.html +load 715056.html +load 729431-1.xhtml +load 741163-1.html +load 745495.html +load 752226-1.html +load 752226-2.html +load 766426.html +load 771639.html +load 786854.html +load 815043.html +load 815276.html +load 815477.html +load 815500.html +load 816253.html +load 819014.html +load 822723.html +load 824719.html +load 827190.html +load 828054.html +load 828903.html +load 829428.html +load 830098.html +load 831287.html +load 832644.html +load 836890.html +load 838489-1.html +load 838489-2.html +load 841205.html +load 844404.html +load 845093-1.html +load 845093-2.html +load 847127.html +load 849601.html +load 849727.html +load 849732.html +load 851353-1.html +load 852381.html +load 863950.html +load 864448.html +load 886213.html +load 898906.html +load 930250.html +load 942979.html +load 973401.html +load 978646.html +load 1024428-1.html +load 1027461-1.html +load 1029710.html +load 1154598.xhtml +load 1157995.html +load 1158412.html +load 1181619.html +load 1228882.html +load 1230422.html +load 1251361.html +load 1281715.html +load 1304437.html +load 1324209.html +load 1324500.html +load 1326194-1.html +load 1326194-2.html +load 1332939.html +load 1341693.html +load 1352453.html +load chrome://reftest/content/crashtests/dom/base/crashtests/1353529.xhtml +load 1368327.html +load chrome://reftest/content/crashtests/dom/base/crashtests/1369363.xhtml +load 1370072.html +pref(clipboard.autocopy,true) load 1370737.html +load 1370968.html +load 1373750.html +load 1377826.html +load 1383478.html +load 1383780.html +pref(clipboard.autocopy,true) load 1385272-1.html +load 1393806.html +load 1396466.html +load 1397795.html +load 1400701.html +load 1403377.html +load 1405771.html +load 1406109-1.html +load 1411473.html +load 1413815.html +load 1419799.html +skip-if(!browserIsRemote) skip-if(geckoview) skip-if(geckoview&&isDebugBuild) skip-if(AddressSanitizer) skip-if(ThreadSanitizer) pref(dom.disable_open_during_load,false) load 1419902.html # skip on non e10s loads, Bug 1419902. Bug 1563013 for GV+WR. Bug 1524493 GV+debug. Bug 1573281 asan +load 1422883.html +load 1428053.html +load 1441029.html +load 1445670.html +load 1449601.html +load 1458016.html +load 1459688.html +load 1460794.html +load 1462548.html +load 1505811.html +load 1505875.html +load 1508845.html +load 1516289.html +load 1516560.html +pref(javascript.options.dynamicImport,true) load 1529203-1.html +skip-if(Android) pref(javascript.options.dynamicImport,true) pref(dom.disable_open_during_load,false) pref(browser.link.open_newwindow,2) load 1529203-2.html +skip-if(Android) pref(dom.disable_open_during_load,false) pref(browser.link.open_newwindow,2) load 1529203-3.html +load 1528675.html +load 1566310.html +skip-if(Android) skip-if(ThreadSanitizer) pref(dom.disable_open_during_load,false) pref(browser.link.open_newwindow,2) load 1588259.html +load structured_clone_container_throws.html +load xhr_empty_datauri.html +load xhr_html_nullresponse.html +asserts(0-1) load 1517025.html # see bug 1666910 for assert +load xhr-with-pagehide-1.html +load 1555786.html +load 1577191.html +load eventSource_invalid_scheme_worker_shutdown.html +load 1291535.html +skip-if(!isDebugBuild||xulRuntime.OS!="Linux") load 1611853.html +load 1619322.html +asserts(0-2) load 1623918.html # May hit an assertion if the <input> element's anonymous tree hasn't been flushed when IMEContentObserver handles focus +load 1656925.html +skip-if(Android) load 1665792.html # Print preview on android doesn't fly +skip-if(ThreadSanitizer) load 1681729.html +skip-if(ThreadSanitizer) load 1693049.html +skip-if(winWidget||Android) pref(print.always_print_silent,true) pref(print.print_to_file,true) pref(print.print_to_filename,"/dev/null") load 1697256.html # Windows seemingly requires pref(print_printer,"Mozilla Save to PDF") but pref() doesn't allow space. Android doesn't support print. +skip-if(ThreadSanitizer||Android) load 1697525.html +skip-if(ThreadSanitizer||Android) load 1712198.html # Mysterious failure that should be investigated (bug 1712866). +skip-if(Android) HTTP load 1728670-1.html +load 1757923.html +load 1766472.html +pref(dom.enable_web_task_scheduling,true) load 1780790.html +load 1700237.html +load 1811939.html +load 1822717.html +load 1835886.html +load 1836824.html +skip-if(Android) load 1838484.html +load 1840191.html diff --git a/dom/base/crashtests/eventSource_invalid_scheme_worker_shutdown-worker.js b/dom/base/crashtests/eventSource_invalid_scheme_worker_shutdown-worker.js new file mode 100644 index 0000000000..d2e5e9e668 --- /dev/null +++ b/dom/base/crashtests/eventSource_invalid_scheme_worker_shutdown-worker.js @@ -0,0 +1,4 @@ +onmessage = function(event) { + close(); + let source = new EventSource(`d:`, {}); +} diff --git a/dom/base/crashtests/eventSource_invalid_scheme_worker_shutdown.html b/dom/base/crashtests/eventSource_invalid_scheme_worker_shutdown.html new file mode 100644 index 0000000000..731392d83d --- /dev/null +++ b/dom/base/crashtests/eventSource_invalid_scheme_worker_shutdown.html @@ -0,0 +1,36 @@ +<html class="reftest-wait"> + <head> + <script type="text/javascript"> + const workerURL = "1614339-worker.js"; + + const Cc = SpecialPowers.Cc; + const Ci = SpecialPowers.Ci; + const wdm = Cc["@mozilla.org/dom/workers/workerdebuggermanager;1"] + .getService(Ci.nsIWorkerDebuggerManager); + + function waitForUnregister() { + return new Promise(function(resolve) { + wdm.addListener({ + onUnregister(dbg) { + if (dbg.url !== workerURL) { + return; + } + wdm.removeListener(this); + resolve(); + }, + }); + }); + } + + function boom() { + const worker = new Worker(workerURL); + waitForUnregister().then(function() { + document.documentElement.classList.remove("reftest-wait"); + }); + worker.postMessage("Start"); + } + </script> + </head> + <body onload="boom();"></body> +</html> + diff --git a/dom/base/crashtests/file_504224.html b/dom/base/crashtests/file_504224.html new file mode 100644 index 0000000000..9031ccbfad --- /dev/null +++ b/dom/base/crashtests/file_504224.html @@ -0,0 +1,7 @@ +<html><head></head> + <body onunload="window.frameElement.parentNode.removeChild(window.frameElement)" tabindex="1"> + <script> +document.body.focus(); + </script> + </body> +</html> diff --git a/dom/base/crashtests/module-with-syntax-error.js b/dom/base/crashtests/module-with-syntax-error.js new file mode 100644 index 0000000000..7edb2fa5bc --- /dev/null +++ b/dom/base/crashtests/module-with-syntax-error.js @@ -0,0 +1 @@ +, diff --git a/dom/base/crashtests/structured_clone_container_throws.html b/dom/base/crashtests/structured_clone_container_throws.html new file mode 100644 index 0000000000..c92c6f4ae1 --- /dev/null +++ b/dom/base/crashtests/structured_clone_container_throws.html @@ -0,0 +1,9 @@ +<iframe></iframe> +<script> +try { frames[0].history.pushState({ dummy: function() {} }, ''); } +catch (e) {} +var doc = frames[0].document; +var s = doc.createElement("script"); +s.textContent = "1"; +doc.body.appendChild(s); +</script> diff --git a/dom/base/crashtests/xhr-with-pagehide-1-helper.html b/dom/base/crashtests/xhr-with-pagehide-1-helper.html new file mode 100644 index 0000000000..efac291708 --- /dev/null +++ b/dom/base/crashtests/xhr-with-pagehide-1-helper.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html> +<head> +<script> +function redirectAndFireXHR() { + const XHR = new XMLHttpRequest(); + document.location.assign('data:text/html,final iframe content'); + XHR.open('GET', 'data:text/html,1', false); + XHR.send(); +} + +function handlePageHide() { + window.parent.finishTest(); +} +</script> +</head> +<body onload="redirectAndFireXHR()" + onpagehide="handlePageHide()"> +initial iframe content +</body> +</html> diff --git a/dom/base/crashtests/xhr-with-pagehide-1.html b/dom/base/crashtests/xhr-with-pagehide-1.html new file mode 100644 index 0000000000..86f074868f --- /dev/null +++ b/dom/base/crashtests/xhr-with-pagehide-1.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<head> + <title> + Crashtest to make sure that a sync XHR during pageload doesn't prevent + pagehide event from firing. + </title> + <script> + function finishTest() { + // Visual indication that we got this far, for humans viewing the test: + document.documentElement.style.backgroundColor = "lime"; + + // Actually finish the test: + document.documentElement.className = ""; + } + </script> +</head> +<body> + <iframe src="xhr-with-pagehide-1-helper.html"></iframe> +</body> +</html> diff --git a/dom/base/crashtests/xhr_empty_datauri.html b/dom/base/crashtests/xhr_empty_datauri.html new file mode 100644 index 0000000000..77988cfe24 --- /dev/null +++ b/dom/base/crashtests/xhr_empty_datauri.html @@ -0,0 +1,5 @@ +<!DOCTYPE html> +<html class="reftest-wait"><meta charset=utf-8> +<script> +var xhr=new XMLHttpRequest();xhr.open("GET","data:,");xhr.responseType='blob';xhr.onloadend=function(){document.documentElement.removeAttribute('class');};xhr.send(); +</script> diff --git a/dom/base/crashtests/xhr_html_nullresponse.html b/dom/base/crashtests/xhr_html_nullresponse.html new file mode 100644 index 0000000000..47c85db9bf --- /dev/null +++ b/dom/base/crashtests/xhr_html_nullresponse.html @@ -0,0 +1,5 @@ +<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+var xhr=new XMLHttpRequest();xhr.open("GET",window.location);xhr.overrideMimeType("text/html");xhr.onprogress=function(){if(xhr.readyState!=3)return;xhr.abort();document.documentElement.removeAttribute('class');};xhr.onabort=function(){xhr.responseText;};xhr.send();
+</script>
|
