diff options
| author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-19 00:47:55 +0000 |
|---|---|---|
| committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-19 00:47:55 +0000 |
| commit | 26a029d407be480d791972afb5975cf62c9360a6 (patch) | |
| tree | f435a8308119effd964b339f76abb83a57c29483 /testing/web-platform/tests/editing/crashtests | |
| parent | Initial commit. (diff) | |
| download | firefox-26a029d407be480d791972afb5975cf62c9360a6.tar.xz firefox-26a029d407be480d791972afb5975cf62c9360a6.zip | |
Adding upstream version 124.0.1.upstream/124.0.1
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'testing/web-platform/tests/editing/crashtests')
109 files changed, 2523 insertions, 0 deletions
diff --git a/testing/web-platform/tests/editing/crashtests/backcolor-in-nested-editing-host-td-from-DOMAttrModified.html b/testing/web-platform/tests/editing/crashtests/backcolor-in-nested-editing-host-td-from-DOMAttrModified.html new file mode 100644 index 0000000000..f8f004b910 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/backcolor-in-nested-editing-host-td-from-DOMAttrModified.html @@ -0,0 +1,29 @@ +<html class="test-wait"> +<head> +<script type="text/javascript"> +function boom() +{ + function x() + { + document.removeEventListener("DOMAttrModified", x); + document.execCommand("backcolor", false, "green"); + } + + document.getElementById("td").focus(); + + document.addEventListener("DOMAttrModified", x); + try { + document.execCommand("subscript", false, null); + } catch(e) { + } + document.removeEventListener("DOMAttrModified", x); + document.documentElement.removeAttribute("class"); +} +</script> +</head> + +<body contenteditable="true" onload="setTimeout(boom, 30);"> +<table><tbody contenteditable="false"><tr><td contenteditable="true" id="td"></td></tr></tbody></table> +</body> + +</html> diff --git a/testing/web-platform/tests/editing/crashtests/bold-in-output.html b/testing/web-platform/tests/editing/crashtests/bold-in-output.html new file mode 100644 index 0000000000..43d78ec4e9 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/bold-in-output.html @@ -0,0 +1,20 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<style> +* { font-weight: bolder } +</style> +<script> +document.addEventListener("DOMContentLoaded", () => { + document.querySelector("output").focus(); + document.execCommand("selectAll"); + document.execCommand("bold"); +}) +</script> +</head> +<body> +<output contenteditable="true"> +A +</output></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/change-input-type-of-focused-text-control-and-make-it-editing-host.html b/testing/web-platform/tests/editing/crashtests/change-input-type-of-focused-text-control-and-make-it-editing-host.html new file mode 100644 index 0000000000..fec4ff13e8 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/change-input-type-of-focused-text-control-and-make-it-editing-host.html @@ -0,0 +1,16 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +document.addEventListener("DOMContentLoaded", () => { + const input = document.createElement("input"); + document.documentElement.appendChild(input); + input.focus(); + input.type = "file"; + input.getBoundingClientRect(); + input.setAttribute("contenteditable", "true"); +}); +</script> +<body></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/contenteditable-will-be-blurred-by-focus-event-listener.html b/testing/web-platform/tests/editing/crashtests/contenteditable-will-be-blurred-by-focus-event-listener.html new file mode 100644 index 0000000000..a887b1de90 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/contenteditable-will-be-blurred-by-focus-event-listener.html @@ -0,0 +1,16 @@ +<!DOCTYPE html> +<html class="test-wait"> +<meta charset="utf-8"> +<script> +addEventListener("load", () => { + const editingHost = document.querySelector("div[contenteditable]"); + editingHost.addEventListener("focus", () => { + document.execCommand("insertText", false, "def"); + editingHost.parentElement.setAttribute("hidden", "hidden"); + setTimeout(() => document.documentElement.removeAttribute("class"), 0); + }); + editingHost.focus(); +}); +</script> +<div><div contenteditable>abc</div></div> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/crash-test.html b/testing/web-platform/tests/editing/crashtests/crash-test.html new file mode 100644 index 0000000000..a7baba30ec --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/crash-test.html @@ -0,0 +1,24 @@ +<!DOCTYPE html> +<meta charset="utf-8"> +<title>Testcase for bug 1273593 of Chromium</title> +<script type="text/javascript"> + function eventhandle_n0BpsTiUS(){ + document.getElementById('id_xEmarzXTw').getBoundingClientRect(); + create_object_mJ9MFgX5.appendChild(document.getElementById('id_nJMWIU7Mp')); + } + function operate(){ + document.getElementById('id_VQmNKZL69').addEventListener('pause', eventhandle_n0BpsTiUS); + create_object_mJ9MFgX5 = document.createElement("canvas"); + event = new Event('pause') + document.getElementById('id_VQmNKZL69').dispatchEvent(event) + }// end exec_event +</script> +<body onload="operate();" contentEditable="true"> + <menu id='id_xEmarzXTw'> + <i id='id_VQmNKZL69' onfocusout='eventhandle_n0BpsTiUS();'> + <nobr id='id_nJMWIU7Mp' > + <iframe onpointerover='eventhandle_n0BpsTiUS();'></iframe> + </nobr> + </i> + </menu> +</body> diff --git a/testing/web-platform/tests/editing/crashtests/delete-after-empty-script-element.html b/testing/web-platform/tests/editing/crashtests/delete-after-empty-script-element.html new file mode 100644 index 0000000000..c06a4af802 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/delete-after-empty-script-element.html @@ -0,0 +1,19 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +</head> +<body> +A +<script> +addEventListener("load", () => { + document.documentElement.contentEditable = true; + getSelection().collapse(document.body.lastChild, document.body.lastChild.length); + document.execCommand("delete"); +}); +</script> +<li> +<form readonly contenteditable> +</form> +<script> +</script></li></body></html> diff --git a/testing/web-platform/tests/editing/crashtests/delete-after-justifyleft-in-closed-editable-dialog.html b/testing/web-platform/tests/editing/crashtests/delete-after-justifyleft-in-closed-editable-dialog.html new file mode 100644 index 0000000000..185cb01ee5 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/delete-after-justifyleft-in-closed-editable-dialog.html @@ -0,0 +1,17 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +addEventListener("load", () => { + const dialog = document.querySelector("dialog"); + dialog.showModal(); + dialog.close(); + document.execCommand("justifyLeft"); + document.execCommand("delete"); +}); +</script> +</head> +<body><dialog contenteditable> +</dialog></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/delete-and-justifycenter-recursively-with-mutation-event-listeners.html b/testing/web-platform/tests/editing/crashtests/delete-and-justifycenter-recursively-with-mutation-event-listeners.html new file mode 100644 index 0000000000..ce0c7e886f --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/delete-and-justifycenter-recursively-with-mutation-event-listeners.html @@ -0,0 +1,34 @@ +<!doctype html> +<html class="test-wait"> +<head> +<meta charset="utf-8"> +<script> +try { + function onDOMNodeInsertedOfContentEditable() { + getSelection().collapse(document.querySelector("input")); + document.execCommand("justifyCenter"); + document.querySelector("dl").addEventListener("DOMSubtreeModified", onDOMSubtreeModifiedOfDLElement); + document.querySelector("dl").appendChild(document.querySelector("style")); + } + function onDOMSubtreeModifiedOfDLElement() { + document.execCommand("delete"); + document.querySelector("label").appendChild(document.querySelector("input")); + document.querySelector("dd[contenteditable]").addEventListener("DOMNodeInserted", onDOMNodeInsertedOfContentEditable); + } + addEventListener("load", () => { + onDOMNodeInsertedOfContentEditable(); + document.documentElement.removeAttribute("class"); + }); +} catch (ex) { + // maybe too many recursive exception would be thrown. + document.documentElement.removeAttribute("class"); +} +</script> +</head> +<body><label></label> +<dl> +<dd contenteditable> +<style>@</style> +<input> +</body> +</html>
\ No newline at end of file diff --git a/testing/web-platform/tests/editing/crashtests/delete-at-next-to-svg-display-table-cell.html b/testing/web-platform/tests/editing/crashtests/delete-at-next-to-svg-display-table-cell.html new file mode 100644 index 0000000000..edb38bb9df --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/delete-at-next-to-svg-display-table-cell.html @@ -0,0 +1,18 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +addEventListener("load", async () => { + document.documentElement.setAttribute("contenteditable", "true"); + getSelection().collapse(document.body.lastChild, document.body.lastChild.length); + document.execCommand("delete"); +}); +</script> +</head> +<body><svg> + <svg display="table-cell"> + </svg> +</svg> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/delete-at-start-of-first-li-in-ol-in-video.html b/testing/web-platform/tests/editing/crashtests/delete-at-start-of-first-li-in-ol-in-video.html new file mode 100644 index 0000000000..43baf25a86 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/delete-at-start-of-first-li-in-ol-in-video.html @@ -0,0 +1,24 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +addEventListener("DOMContentLoaded", () => { + getSelection().collapse(document.querySelector("ol"), 0); + document.execCommand("delete"); +}); +</script> +</head> +<body> +<details open contenteditable> +<map> +<video> +<source></source> +<ol> +<li>a</li> +</ol> +</video> +</map> +</details> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/delete-at-text-following-svg.html b/testing/web-platform/tests/editing/crashtests/delete-at-text-following-svg.html new file mode 100644 index 0000000000..cc2040a2a3 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/delete-at-text-following-svg.html @@ -0,0 +1,41 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<style> +mask, li { + float: inline-start; + animation-name: kf0; +} +@keyframes kf0 {} +</style> +<script> +document.addEventListener("DOMContentLoaded", () => { + window.focus(); + document.designMode = "on"; + document.onpointerlockerror = onPointerLockErrorOrAnimationStart; + const mask = document.querySelector("mask"); + mask.requestPointerLock(); + mask.prepend(document.querySelector("table")); +}); +function onPointerLockErrorOrAnimationStart() { + document.execCommand("underline"); + document.execCommand("delete"); + onanimationstart = onPointerLockErrorOrAnimationStart; + try { + getSelection().setBaseAndExtent( + document.querySelector("li"), 0, + document.querySelector("thead"), 0 + ); + } catch (e) {} +} +</script> +<body><svg> +<mask> +<clipPath> +</clipPath></mask></svg><sup> +AA +<li> +<br></li></sup><table> +<thead> +</thead></table> diff --git a/testing/web-platform/tests/editing/crashtests/delete-content-in-no-data-object.html b/testing/web-platform/tests/editing/crashtests/delete-content-in-no-data-object.html new file mode 100644 index 0000000000..749dba303b --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/delete-content-in-no-data-object.html @@ -0,0 +1,31 @@ +<!doctype html> +<html class="test-wait"> +<head> +<meta charset="utf-8"> +<script> +document.addEventListener("DOMContentLoaded", () => { + requestAnimationFrame(() => { + setTimeout(() => { + document.execCommand("delete"); + document.documentElement.removeAttribute("class"); + }, 0); + document.execCommand("insertImage", false, "x"); + }); + document.execCommand("justifyCenter"); +}) +function onError() { + document.querySelector("s").before("BEFORE"); + document.designMode = "on"; + const img = document.querySelector("img"); + img.innerHTML = "IMG"; + getSelection().setBaseAndExtent(document.querySelector("kbd"), 0, img, 1); +} +</script> +</head> +<body><object onerror="onError()"> +<s> +<img> +SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS +<kbd> +</kbd></s></object></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/delete-from-after-empty-table-header-grouped-element.html b/testing/web-platform/tests/editing/crashtests/delete-from-after-empty-table-header-grouped-element.html new file mode 100644 index 0000000000..e6ad4fa9e3 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/delete-from-after-empty-table-header-grouped-element.html @@ -0,0 +1,16 @@ +<!doctype html> +<html> +<head> +<meta char="utf-8"> +<script> +addEventListener("load", () => { + document.documentElement.contentEditable = true; + getSelection().collapse(document.querySelector("svg"), document.querySelector("svg").childNodes.length); + document.execCommand("delete"); +}); +</script> +<body> +<svg> + <a display="table-header-group"> + </a> + </svg></body></html>
\ No newline at end of file diff --git a/testing/web-platform/tests/editing/crashtests/delete-from-ruby-at-start-of-button.html b/testing/web-platform/tests/editing/crashtests/delete-from-ruby-at-start-of-button.html new file mode 100644 index 0000000000..0159e52815 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/delete-from-ruby-at-start-of-button.html @@ -0,0 +1,29 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<style> +*:last-child { + white-space: pre-wrap; +} +</style> +<script> +addEventListener("DOMContentLoaded", () => { + getSelection().collapse(document.querySelector("ruby")); + document.designMode = "on"; + document.execCommand("delete"); +}); +</script> +</head> +<body> +<label contenteditable="true"></label> +<bdi style="white-space: nowrap"> +<button> +<kbd> +<ruby> +</ruby> +</kbd> +</button> +</bdi> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/delete-immediately-after-changing-input-type-from-time.html b/testing/web-platform/tests/editing/crashtests/delete-immediately-after-changing-input-type-from-time.html new file mode 100644 index 0000000000..e608b8c866 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/delete-immediately-after-changing-input-type-from-time.html @@ -0,0 +1,23 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +document.addEventListener("DOMContentLoaded", () => { + const input = document.querySelector("input"); + requestAnimationFrame(() => { + document.body.appendChild(document.querySelector("time")); + input.value = "A"; + }); + input.focus(); + input.setAttribute("type", "text"); + document.execCommand("delete"); +}); +</script> +</head> +<body> +<input type="time"> +<time> +<dir> +<li></li></dir></time></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/delete-in-block-in-progress.html b/testing/web-platform/tests/editing/crashtests/delete-in-block-in-progress.html new file mode 100644 index 0000000000..233b834ab0 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/delete-in-block-in-progress.html @@ -0,0 +1,25 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +document.addEventListener("DOMContentLoaded", () => { + document.querySelector("mo").appendChild(document.querySelector("dialog")); + getSelection().collapse(document.querySelector("template"), 0); + document.execCommand("delete"); +}, {once:true}); +</script> +<body> +<dialog> +<template> +</template> +</dialog> +<dl contenteditable> +<li> +<b><progress> +<mo>a</mo> +</progress></b> +</li> +</dl> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/delete-in-dd-editing-host-after-selectall-with-focus.html b/testing/web-platform/tests/editing/crashtests/delete-in-dd-editing-host-after-selectall-with-focus.html new file mode 100644 index 0000000000..585cd17bb8 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/delete-in-dd-editing-host-after-selectall-with-focus.html @@ -0,0 +1,12 @@ +<script> +addEventListener("DOMContentLoaded", () => { + document.querySelector("dd[contenteditable]").focus(); + document.querySelector("dd[contenteditable]").addEventListener("DOMNodeRemoved", () => { + document.querySelector("h6").textContent = ""; + }); + document.execCommand("selectAll"); + document.execCommand("delete"); +}) +</script> +<h6> +<dd contenteditable> diff --git a/testing/web-platform/tests/editing/crashtests/delete-in-dd-editing-host-after-selectall-without-focus.html b/testing/web-platform/tests/editing/crashtests/delete-in-dd-editing-host-after-selectall-without-focus.html new file mode 100644 index 0000000000..a45f2dad82 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/delete-in-dd-editing-host-after-selectall-without-focus.html @@ -0,0 +1,12 @@ +<script> +addEventListener("DOMContentLoaded", () => { + document.querySelector("dd[contenteditable]").blur(); + document.querySelector("dd[contenteditable]").addEventListener("DOMNodeRemoved", () => { + document.querySelector("h6").textContent = ""; + }); + document.execCommand("selectAll"); + document.execCommand("delete"); +}) +</script> +<h6> +<dd contenteditable> diff --git a/testing/web-platform/tests/editing/crashtests/delete-in-designMode-without-explicitly-setting-focus.html b/testing/web-platform/tests/editing/crashtests/delete-in-designMode-without-explicitly-setting-focus.html new file mode 100644 index 0000000000..16e1808dc8 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/delete-in-designMode-without-explicitly-setting-focus.html @@ -0,0 +1,17 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +document.addEventListener("DOMContentLoaded", () => { + const dl = document.querySelector("dl"); + dl.textContent = "�"; + document.designMode = "on"; + document.execCommand("delete"); +}) +</script> +</head> +<del> + <dl></dl> +</del> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/delete-in-empty-editable-list-followed-by-non-editable-listitem.html b/testing/web-platform/tests/editing/crashtests/delete-in-empty-editable-list-followed-by-non-editable-listitem.html new file mode 100644 index 0000000000..9e872f5ac4 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/delete-in-empty-editable-list-followed-by-non-editable-listitem.html @@ -0,0 +1,13 @@ +<!DOCTYPE html> +<html id="a"> +<meta charset="utf-8"> +<script id="b"> +window.onload = () => { + c.appendChild(document.head) + a.appendChild(d) + document.execCommand("selectAll") + document.execCommand("delete") +} +</script> +<dl id="c" contenteditable="true"> +<dt id="d"> diff --git a/testing/web-platform/tests/editing/crashtests/designMode-document-will-be-blurred-by-focus-event-listener.html b/testing/web-platform/tests/editing/crashtests/designMode-document-will-be-blurred-by-focus-event-listener.html new file mode 100644 index 0000000000..3cd6509c4b --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/designMode-document-will-be-blurred-by-focus-event-listener.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html class="test-wait"> +<meta charset="utf-8"> +<script> +addEventListener("load", () => { + const parentDocument = document; + const iframe = parentDocument.querySelector("iframe"); + iframe.contentDocument.designMode = "on"; + iframe.contentWindow.addEventListener("focus", () => { + iframe.contentDocument.execCommand("insertText", false, "def"); + iframe.parentElement.setAttribute("hidden", "hidden"); + setTimeout(() => parentDocument.documentElement.removeAttribute("class"), 0); + }); + iframe.contentWindow.focus(); +}); +</script> +<div><iframe srcdoc="<div>abc</div>"></iframe></div> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/designMode-off-during-inserthorizontalrule.html b/testing/web-platform/tests/editing/crashtests/designMode-off-during-inserthorizontalrule.html new file mode 100644 index 0000000000..21a6199898 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/designMode-off-during-inserthorizontalrule.html @@ -0,0 +1,22 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +document.addEventListener("DOMContentLoaded", () => { + document.designMode = "on"; + document.addEventListener("DOMNodeRemoved", () => { + document.documentElement.normalize(); + document.designMode = "off"; + }); + getSelection().collapse(document.querySelector("address").firstChild, 1); + document.execCommand("insertHorizontalRule"); +}); +</script> +</head> +<body> +<address> +A +</address> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/designMode-on-of-lazy-loading-iframe.html b/testing/web-platform/tests/editing/crashtests/designMode-on-of-lazy-loading-iframe.html new file mode 100644 index 0000000000..90a6c85c45 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/designMode-on-of-lazy-loading-iframe.html @@ -0,0 +1,20 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<style> +*::first-letter {} +</style> +<script> +addEventListener("load", () => { + const iframe = document.querySelector("iframe"); + iframe.contentWindow.focus(); + document.styleSheets[0].deleteRule(0); + iframe.contentWindow.document.designMode = "on"; +}); +</script> +</head> +<body> +<iframe loading="lazy"> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/execCommand-at-load-with-changing-editing-host.html b/testing/web-platform/tests/editing/crashtests/execCommand-at-load-with-changing-editing-host.html new file mode 100644 index 0000000000..ec1dd30dc0 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/execCommand-at-load-with-changing-editing-host.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html contenteditable="true"> +<head> +<meta charset="utf-8"> +<title>Test for bug 615450 of Mozilla</title> +<script> +function boom() +{ + document.documentElement.appendChild(document.body); + document.documentElement.contentEditable = "false"; + try { document.execCommand("outdent", false, null); } catch(e) { } + document.body.contentEditable = "true"; + try { document.execCommand("inserthtml", false, "x"); } catch(e) { } +} +</script> +</head> +<body onload="boom();"><div style="margin-left: 40px;"><span contenteditable="true">p q r s</span> T</div></body></html> diff --git a/testing/web-platform/tests/editing/crashtests/execCommand-backcolor-and-hilitecolor-in-empty-iframe-in-designMode.html b/testing/web-platform/tests/editing/crashtests/execCommand-backcolor-and-hilitecolor-in-empty-iframe-in-designMode.html new file mode 100644 index 0000000000..0750dddca7 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/execCommand-backcolor-and-hilitecolor-in-empty-iframe-in-designMode.html @@ -0,0 +1,116 @@ +<!DOCTYPE HTML> +<html><head> + <meta charset="iso-8859-1"> + <title>Testcase #3 for bug 448329 of Bugzilla</title> +</head> +<body> + +<iframe id="frame448329"></iframe> + +<script> + +function test448329(id,cmd,val) { + + var elm = document.getElementById(id); + var doc = elm.contentDocument; + doc.designMode = "On"; + + doc.body.offsetWidth; + var selection = doc.defaultView.getSelection(); + + // Test document node + if (selection.rangeCount > 0) { + selection.removeAllRanges(); + } + var range = doc.createRange(); + range.setStart(doc, 0); + range.setEnd(doc, 0); + selection.addRange(range); + doc.execCommand(cmd,false,val); + + // Test HTML node + if (selection.rangeCount > 0) { + selection.removeAllRanges(); + } + range = doc.createRange(); + range.setStart(doc.documentElement, 0); + range.setEnd(doc.documentElement, 0); + selection.addRange(range); + doc.execCommand(cmd,false,val); + + // Test BODY node + if (selection.rangeCount > 0) { + selection.removeAllRanges(); + } + range = doc.createRange(); + var body = doc.documentElement.childNodes[1]; + range.setStart(body, 0); + range.setEnd(body, 0); + selection.addRange(range); + doc.execCommand(cmd,false,val); + + var text = doc.createTextNode("Hello Kitty"); + body.insertBefore(text, null) + + // Test TEXT node + if (selection.rangeCount > 0) { + selection.removeAllRanges(); + } + range = doc.createRange(); + range.setStart(text, 0); + range.setEnd(text, 1); + selection.addRange(range); + doc.execCommand(cmd,false,val); + + // Test BODY[0,0] + TEXT node + if (selection.rangeCount > 0) { + selection.removeAllRanges(); + } + range = doc.createRange(); + range.setStart(body, 0); + range.setEnd(body, 0); + selection.addRange(range); + range = doc.createRange(); + range.setStart(text, 0); + range.setEnd(text, 1); + selection.addRange(range); + doc.execCommand(cmd,false,val); + + // Test BODY[0,1] + TEXT node + if (selection.rangeCount > 0) { + selection.removeAllRanges(); + } + range = doc.createRange(); + range.setStart(body, 0); + range.setEnd(body, 1); + selection.addRange(range); + range = doc.createRange(); + range.setStart(text, 0); + range.setEnd(text, 1); + selection.addRange(range); + doc.execCommand(cmd,false,val); + + // Test BODY[0,1] + TEXT node without a parent + if (selection.rangeCount > 0) { + selection.removeAllRanges(); + } + range = doc.createRange(); + range.setStart(body, 0); + range.setEnd(body, 1); + selection.addRange(range); + range = doc.createRange(); + text = doc.createTextNode("Hello there"); // not in doc + range.setStart(text, 0); + range.setEnd(text, 1); + selection.addRange(range); + doc.execCommand(cmd,false,val); +} + +test448329("frame448329", "backcolor", "green") +test448329("frame448329", "hilitecolor", "green") + +</script> + + +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/execCommand-without-selection-ranges.html b/testing/web-platform/tests/editing/crashtests/execCommand-without-selection-ranges.html new file mode 100644 index 0000000000..04913664e6 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/execCommand-without-selection-ranges.html @@ -0,0 +1,65 @@ +<!doctype html> +<head> +<meta charset="utf-8"> +</head> +<body> +<script> +for (const command of [ + ["bold", ""], + ["italic", ""], + ["underline", ""], + ["strikethrough", ""], + ["subscript", ""], + ["superscript", ""], + ["cut", ""], + ["copy", ""], + ["paste", ""], + ["delete", ""], + ["forwarddelete", ""], + ["selectall", ""], + ["undo", ""], + ["redo", ""], + ["indent", ""], + ["outdent", ""], + ["backcolor", "#888888"], + ["forecolor", "#888888"], + ["hilitecolor", "#888888"], + ["fontname", "Courier"], + ["fontsize", "6"], + ["increasefontsize", ""], + ["decreasefontsize", ""], + ["inserthorizontalrule", ""], + ["createlink", "foo"], + ["insertimage", "foo"], + ["inserthtml", "foo"], + ["inserttext", "foo"], + ["insertparagraph", ""], + ["gethtml", ""], + ["justifyleft", ""], + ["justifyright", ""], + ["justifycenter", ""], + ["justifyfull", ""], + ["removeformat", ""], + ["unlink", ""], + ["insertorderedlist", ""], + ["insertunorderedlist", ""], + ["formatblock", "h1"], + ["heading", "h1"], + ["stylewithcss", "true"], + ["usecss", "true"], + ["contentreadonly", "true"], + ["readonly", "true"], + ["insertbronreturn", "true"], + ["enableobjectresizing", "true"], + ["enableinlinetableediting", "true"], +]) { + document.body.innerHTML = "<div contenteditable>abc</div>"; + document.querySelector("div[contenteditable]").focus(); + getSelection().removeAllRanges(); + try { + document.execCommand(command[0], false, command[1]); + } catch(e) {} +} +</script> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/format-block-selection-containing-non-editable-list.html b/testing/web-platform/tests/editing/crashtests/format-block-selection-containing-non-editable-list.html new file mode 100644 index 0000000000..2f8f8ea5ab --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/format-block-selection-containing-non-editable-list.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html> +<head> + <script> + window.addEventListener('load', () => { + document.execCommand('selectAll', false, null) + document.execCommand('formatBlock', false, 'h1') + }) + </script> +</head> +<body> +<main contenteditable='true'> + <li></li> + <ol contenteditable='false'> + </ol> +</main> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/forwarddelete-after-editable-slot-element-outside-body.html b/testing/web-platform/tests/editing/crashtests/forwarddelete-after-editable-slot-element-outside-body.html new file mode 100644 index 0000000000..480f02ded9 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/forwarddelete-after-editable-slot-element-outside-body.html @@ -0,0 +1,28 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +document.addEventListener("DOMContentLoaded", () => { + const slot = document.createElement("slot"); + document.documentElement.appendChild(slot); + const anchor = document.querySelector("a[contenteditable]"); + const selection = document.getSelection() + getSelection().collapse(anchor, 0); + getSelection().setBaseAndExtent( + document, 0, + document.documentElement, document.documentElement.childNodes.length + ); + const range = selection.getRangeAt(0); + document.documentElement.contentEditable = true; + document.documentElement.contentEditable = false; + range.collapse(false); + getSelection().removeAllRanges(); + getSelection().addRange(range); + document.documentElement.contentEditable = true; + document.execCommand("forwardDelete"); +}); +</script> +</head><body> +<a contenteditable></a> +</body></html> diff --git a/testing/web-platform/tests/editing/crashtests/forwarddelete-at-empty-text-node-in-body.html b/testing/web-platform/tests/editing/crashtests/forwarddelete-at-empty-text-node-in-body.html new file mode 100644 index 0000000000..4fba13d5d8 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/forwarddelete-at-empty-text-node-in-body.html @@ -0,0 +1,8 @@ +<body contenteditable=true>x y +<script> +document.body.firstChild.splitText(2) // "x " and " y" + .splitText(1) // "x", " " and " y" + .splitText(1); // "x", "", " " and " y" +getSelection().collapse(document.body, 1); +document.execCommand("forwardDelete"); +</script> diff --git a/testing/web-platform/tests/editing/crashtests/forwarddelete-delete-after-justifyleft-indent.html b/testing/web-platform/tests/editing/crashtests/forwarddelete-delete-after-justifyleft-indent.html new file mode 100644 index 0000000000..0b0e188732 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/forwarddelete-delete-after-justifyleft-indent.html @@ -0,0 +1,20 @@ +<script> +document.addEventListener("DOMContentLoaded", () => { + const fieldset = document.querySelector("fieldset"); + document.documentElement.contentEditable = true; + fieldset.contentEditable = false; + document.execCommand("justifyLeft"); + document.designMode = "on"; + document.execCommand("indent"); + document.execCommand("forwardDelete"); + document.execCommand("delete"); +}); +</script> +<acronym readonly autofocus> +<sup> +<fieldset> + +here is fieldset +</fieldset> +</acronym> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/forwarddelete-in-list-editing-host-after-selectall-with-focus.html b/testing/web-platform/tests/editing/crashtests/forwarddelete-in-list-editing-host-after-selectall-with-focus.html new file mode 100644 index 0000000000..266cc4fb60 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/forwarddelete-in-list-editing-host-after-selectall-with-focus.html @@ -0,0 +1,15 @@ +<script> +addEventListener("load", () => { + document.querySelector("ol[contenteditable]").focus(); + document.execCommand("selectAll"); + const targetListItem = document.querySelector("li + li"); + targetListItem.addEventListener("DOMSubtreeModified", () => { + document.execCommand("forwardDelete"); + document.querySelector("script").appendChild(targetListItem); + }); + targetListItem.setAttribute("scrolling", "auto"); +}); +</script> +<ol contenteditable> +<li> +<li>a</li> diff --git a/testing/web-platform/tests/editing/crashtests/forwarddelete-in-list-editing-host-after-selectall-without-focus.html b/testing/web-platform/tests/editing/crashtests/forwarddelete-in-list-editing-host-after-selectall-without-focus.html new file mode 100644 index 0000000000..de10e8b8a9 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/forwarddelete-in-list-editing-host-after-selectall-without-focus.html @@ -0,0 +1,15 @@ +<script> +addEventListener("load", () => { + document.querySelector("ol[contenteditable]").blur(); + document.execCommand("selectAll"); + const targetListItem = document.querySelector("li + li"); + targetListItem.addEventListener("DOMSubtreeModified", () => { + document.execCommand("forwardDelete"); + document.querySelector("script").appendChild(targetListItem); + }); + targetListItem.setAttribute("scrolling", "auto"); +}); +</script> +<ol contenteditable> +<li> +<li>a</li> diff --git a/testing/web-platform/tests/editing/crashtests/forwarddelete-in-text-in-span-in-editable-documentElement.html b/testing/web-platform/tests/editing/crashtests/forwarddelete-in-text-in-span-in-editable-documentElement.html new file mode 100644 index 0000000000..26f2f64b81 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/forwarddelete-in-text-in-span-in-editable-documentElement.html @@ -0,0 +1,15 @@ +<!doctype html> +<script> +addEventListener("load", () => { + const r = document.documentElement; + while (r.firstChild) { + r.firstChild.remove(); + } + + document.documentElement.contentEditable = "true"; + document.documentElement.appendChild(document.createElement("span")); + document.documentElement.firstChild.appendChild(document.createTextNode("_")); + document.execCommand("forwarddelete"); +}); +</script> +<body> diff --git a/testing/web-platform/tests/editing/crashtests/indent-in-inline-editing-host-outside-body.html b/testing/web-platform/tests/editing/crashtests/indent-in-inline-editing-host-outside-body.html new file mode 100644 index 0000000000..d56a0fd248 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/indent-in-inline-editing-host-outside-body.html @@ -0,0 +1,18 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +addEventListener("load", () => { + const samp = document.createElement("samp"); + samp.innerText = "ABC"; + samp.contentEditable = true; + document.documentElement.appendChild(samp); + getSelection().selectAllChildren(samp); + document.execCommand("indent"); +}); +</script> +</head> +<body> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/indent-in-textarea-in-designMode-during-outdent.html b/testing/web-platform/tests/editing/crashtests/indent-in-textarea-in-designMode-during-outdent.html new file mode 100644 index 0000000000..313c51bb5a --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/indent-in-textarea-in-designMode-during-outdent.html @@ -0,0 +1,34 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +</head> +<body> +A +<script> +addEventListener("load", () => { + const textarea = document.querySelector("textarea"); + textarea.addEventListener("focusin", onFocusIn); + textarea.select(); + document.execCommand("outdent"); +}); + +function onFocusIn() { + document.querySelector("marquee").onstart = () => { + document.designMode = "off"; + window.find("AA"); + }; + document.designMode = "on"; + document.execCommand("selectAll"); + document.execCommand("indent"); + document.designMode = "on"; +} +</script> +<fieldset> +<textarea></textarea> +AA +</fieldset> +<marquee id="b"></marquee> +<blockquote contenteditable="true"></blockquote> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/indent-outdent-after-closing-editable-dialog-element.html b/testing/web-platform/tests/editing/crashtests/indent-outdent-after-closing-editable-dialog-element.html new file mode 100644 index 0000000000..7f73de048d --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/indent-outdent-after-closing-editable-dialog-element.html @@ -0,0 +1,31 @@ +<html class="reftest-wait"> +<script> +var eventCount = 0; +document.addEventListener("DOMContentLoaded", () => { + const dialog = document.querySelector("dialog"); + const object = document.createElement("object"); + object.addEventListener("DOMSubtreeModified", () => { + dialog.show(); + dialog.focus(); + document.execCommand("selectAll"); + dialog.close(); + setTimeout(() => { + document.execCommand("selectAll"); + document.execCommand("strikeThrough"); + document.execCommand("indent"); + document.execCommand("outdent"); + eventCount--; + if (!eventCount) { + document.documentElement.removeAttribute("class"); + } + }); + eventCount++; + }); + object.setAttribute("role", "x"); // Run DOMSubtreeModified + object.setAttribute("role", "y"); // Run DOMSubtreeModified + document.execCommand("forwardDelete"); + document.execCommand("justifyRight"); +}) +</script> +<dialog id="a" contenteditable="true">a</dialog> +</html>
\ No newline at end of file diff --git a/testing/web-platform/tests/editing/crashtests/insert-image-with-joining-header-element-and-body.html b/testing/web-platform/tests/editing/crashtests/insert-image-with-joining-header-element-and-body.html new file mode 100644 index 0000000000..cf5b2df225 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/insert-image-with-joining-header-element-and-body.html @@ -0,0 +1,24 @@ +<!DOCTYPE html> +<html> +<head> + <script> + window.addEventListener("load", () => { + const heading = document.getElementById("heading") + const input = document.createElementNS("http://www.w3.org/1999/xhtml", "input") + heading.appendChild(input) + const selection = window.getSelection() + const range = new Range() + range.setStartBefore(input) + heading.contentEditable = true + document.execCommand("selectAll", false, null) + document.designMode = "on" + selection.addRange(range) + range.setEndBefore(heading) + range.setEndAfter(heading) + document.execCommand("insertImage", false, "wss://:pass@[::1]$/") + }) + </script> +</head> +<h4 id="heading"></h4> +<!-- COMMENT --> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/insertAdjacentElement-with-DOMSubtreeModified.html b/testing/web-platform/tests/editing/crashtests/insertAdjacentElement-with-DOMSubtreeModified.html new file mode 100644 index 0000000000..4b9533282d --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/insertAdjacentElement-with-DOMSubtreeModified.html @@ -0,0 +1,26 @@ +<!DOCTYPE html> +<head> +<script src="../resources/js-test.js"></script> +<script> +function onLoad() { + const x1 = document.getElementById('x1'); + x1.addEventListener('DOMSubtreeModified', () => { + const x2 = document.getElementById('x2'); + x2.contentDocument; + }); + x1.setAttribute('inputmode', 'url'); +} +function insertAdjacent() { + const x2 = document.getElementById('x2'); + const x3 = document.getElementById('x3'); + document.onreadystatechange = insertAdjacent; + x3.insertAdjacentElement('beforebegin', x2); +} +</script> +</head> +<body onload="onLoad()"> +<div id="x1"></div> +<object id="x2" data="invalid-url" onerror="insertAdjacent()"></object> +<div id="x3"></div> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/insertText-at-end-of-text-in-body.html b/testing/web-platform/tests/editing/crashtests/insertText-at-end-of-text-in-body.html new file mode 100644 index 0000000000..763697314b --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/insertText-at-end-of-text-in-body.html @@ -0,0 +1,16 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="utf-8"> +<script> +addEventListener("load", event => { + document.body.focus(); + const text = document.createTextNode("x".repeat(15)); + document.body.appendChild(text); + getSelection().collapse(text, text.length); + document.execCommand("insertText", false, "a"); +}); +</script> +</head> +<body contenteditable></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/insertText-nested-by-DOMSubtreeModified.html b/testing/web-platform/tests/editing/crashtests/insertText-nested-by-DOMSubtreeModified.html new file mode 100644 index 0000000000..45b0e67ed4 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/insertText-nested-by-DOMSubtreeModified.html @@ -0,0 +1,29 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +document.addEventListener("DOMContentLoaded", () => { + const output = document.querySelector("output"); + const table = document.querySelector("table"); + table.addEventListener("DOMSubtreeModified", () => { + document.execCommand("bold"); + document.execCommand("hiliteColor", false, "white"); + output.appendChild(table); + document.execCommand("forwardDelete"); + table.setAttribute("onwebkitsourceclose", "foo()"); + document.execCommand("insertText", false, "a"); + }); + document.execCommand("selectAll"); + table.insertRow(); +}); +</script> +</head> +<body> +<canvas contenteditable> +<output> +<table tabindex="0" autofocus></table> +</output> +</canvas> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-in-fieldset-and-everything-styled-white-space-pre.html b/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-in-fieldset-and-everything-styled-white-space-pre.html new file mode 100644 index 0000000000..d06157e784 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-in-fieldset-and-everything-styled-white-space-pre.html @@ -0,0 +1,25 @@ +<!DOCTYPE html> +<html> +<head> + <style> + * { + white-space: pre + } + </style> + <script> + document.addEventListener('DOMContentLoaded', () => { + const quote_0 = document.getElementById('id_0') + const quote_1 = document.createElement('blockquote') + const fieldset_1 = document.createElement('fieldset') + quote_1.appendChild(fieldset_1) + document.documentElement.appendChild(quote_1) + const selection = self.getSelection() + selection.collapse(fieldset_1, 0) + quote_0.contentEditable = false + document.documentElement.contentEditable = true + document.execCommand('insertHorizontalRule', false, null) + }) + </script> +</head> +<blockquote id='id_0'></blockquote> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-in-textarea-in-editor-and-undo-on-error-events.html b/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-in-textarea-in-editor-and-undo-on-error-events.html new file mode 100644 index 0000000000..204f75a89f --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-in-textarea-in-editor-and-undo-on-error-events.html @@ -0,0 +1,31 @@ +<!doctype html> +<html class="test-wait"> +<head> +<meta charset="utf-8"> +<script> +var count = 0; +function onError() { + if (++count > 2) { + document.documentElement.removeAttribute("class"); + return; + } + const object = document.getElementById("a"); + const mi = document.getElementById("b"); + object.data = ""; + object.appendChild(document.getElementById("c")); + mi.appendChild(document.getElementById("c")); + getSelection().collapse(document.getElementById("c"), 0); + document.execCommand("undo"); + document.execCommand("insertHorizontalRule"); +} +</script> +</head> +<body> +<textarea id="c">a</textarea> +<dt contenteditable="true"> +<mi id="b">#</mi> +<object id="a" onerror="onError()"> +</object> +</dt> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-with-2-selection-ranges-and-one-is-outside-body.html b/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-with-2-selection-ranges-and-one-is-outside-body.html new file mode 100644 index 0000000000..d248c333d9 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-with-2-selection-ranges-and-one-is-outside-body.html @@ -0,0 +1,19 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="utf-8"> +<script> +document.addEventListener('DOMContentLoaded', () => { + const form = document.createElement("form"); + const range = new Range(); + document.documentElement.contentEditable = true; + document.execCommand("formatBlock", false, "h3"); + document.documentElement.appendChild(form); + range.setStartBefore(form); + getSelection().addRange(range); + range.selectNode(form); + document.execCommand("insertHorizontalRule"); +}); +</script> +</head> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-with-range-ending-in-collapsible-spaces-before-comment.html b/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-with-range-ending-in-collapsible-spaces-before-comment.html new file mode 100644 index 0000000000..d7224c3095 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-with-range-ending-in-collapsible-spaces-before-comment.html @@ -0,0 +1,25 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +document.addEventListener("DOMContentLoaded", () => { + getSelection().setBaseAndExtent( + document.querySelector("b"), 0, + document.querySelector("i").firstChild, 2 + ); + document.documentElement.contentEditable = true; + document.execCommand("insertHorizontalRule"); +}); +</script> +</head> +<body> +<div> +<b> +</b> +<i>X +</i> +<!-- COMMENT --> +</div> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-with-selecting-text-in-document-element.html b/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-with-selecting-text-in-document-element.html new file mode 100644 index 0000000000..c46b0359e8 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/inserthorizontalrule-with-selecting-text-in-document-element.html @@ -0,0 +1,18 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +document.addEventListener("DOMContentLoaded", () => { + const text = document.createTextNode("abc"); + document.documentElement.appendChild(text); + const range = new Range(); + range.selectNodeContents(text); + document.documentElement.contentEditable = "true"; + document.execCommand("insertUnorderedList"); + getSelection().addRange(range); + document.execCommand("insertHorizontalRule"); +}); +</script> +</head> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/inserthtml-after-temporarily-removing-document-element.html b/testing/web-platform/tests/editing/crashtests/inserthtml-after-temporarily-removing-document-element.html new file mode 100644 index 0000000000..7245fe3ddc --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/inserthtml-after-temporarily-removing-document-element.html @@ -0,0 +1,27 @@ +<!DOCTYPE html> +<html class="test-wait"> +<head> +<meta charset="utf-8"> +<title>Testcase for bug 716456 of Mozilla</title> +<script> +function boom() { + const div = document.querySelector("div"); + div.contentEditable = "true"; + div.focus(); + + const root = document.documentElement; + document.removeChild(root); + document.appendChild(root); + + setTimeout(() => { + getSelection().collapse(div, 0); + document.execCommand("inserthtml", false, "a"); + setTimeout(() => { + document.documentElement.removeAttribute("class"); + }, 0); + }, 0); +} +</script> +</head> +<body onload="boom();"><div></div></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/inserthtml-in-inline-editing-host-at-load-event.html b/testing/web-platform/tests/editing/crashtests/inserthtml-in-inline-editing-host-at-load-event.html new file mode 100644 index 0000000000..22f172856a --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/inserthtml-in-inline-editing-host-at-load-event.html @@ -0,0 +1,7 @@ +<html> +<head> +</head> + +<body onload="try { document.execCommand('inserthtml', false, '0'); } catch(e) { }"><span id="textarea" contenteditable="true">is</span></body> + +</html> diff --git a/testing/web-platform/tests/editing/crashtests/inserthtml-in-li-in-option.html b/testing/web-platform/tests/editing/crashtests/inserthtml-in-li-in-option.html new file mode 100644 index 0000000000..c8aa9f780f --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/inserthtml-in-li-in-option.html @@ -0,0 +1,25 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +"use strict"; +document.addEventListener("DOMContentLoaded", () => { + const select = document.querySelector("select"); + select.appendChild(document.querySelector("option")); + select.appendChild(document.createElement("optgroup")); + document.querySelector("p").appendChild(document.querySelector("li[contenteditable]")); + getSelection().collapse(document.querySelector("output"), 0); + document.execCommand("insertHTML", false, select.innerHTML); +}); +</script> +</head> +<body> +<dl> +<select>a</select> +<p></p> +<option> +<li contenteditable> +<output> +</output><li></option></dl></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/inserthtml-in-text-adopted-to-other-document.html b/testing/web-platform/tests/editing/crashtests/inserthtml-in-text-adopted-to-other-document.html new file mode 100644 index 0000000000..d8234f917a --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/inserthtml-in-text-adopted-to-other-document.html @@ -0,0 +1,52 @@ +<!DOCTYPE html> +<html class="test-wait"> +<head> +<script> +function init1() +{ + targetIframe = document.createElementNS('http://www.w3.org/1999/xhtml', 'iframe'); + targetIframe.srcdoc = "<html></html>"; + targetIframe.setAttribute("style", "width: 300px; height: 200px; border: 1px dotted green;"); + targetIframe.addEventListener("load", init2); + document.body.appendChild(targetIframe); +} + +function init2() +{ + targetWindow = targetIframe.contentWindow; + targetDocument = targetWindow.document; + + var div = document.getElementById("div"); + textNode = div.firstChild; + + targetDocument.body.appendChild(targetDocument.adoptNode(div, true)); + + targetDocument.designMode = 'on'; + setTimeout(init3, 0); +} + +function init3() +{ + var rng = targetDocument.createRange(); + rng.setStart(textNode, 1); + rng.setEnd(textNode, 1); + targetWindow.getSelection().addRange(rng); + + try { + targetDocument.execCommand("inserthtml", false, "<p>"); + } catch(e) {} + + document.documentElement.removeAttribute("class"); +} +</script> + +</head> + +<body onload="init1();"> + +<div id="div"> </div> + +<script> +</script> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/inserthtml-indent-delete-when-input-element-in-editing-host-has-focus.html b/testing/web-platform/tests/editing/crashtests/inserthtml-indent-delete-when-input-element-in-editing-host-has-focus.html new file mode 100644 index 0000000000..ff1eebe041 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/inserthtml-indent-delete-when-input-element-in-editing-host-has-focus.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="utf-8"> +<title>Test for bug 636074 of Mozilla</title> +<script> +function boom() +{ + document.getElementById("i").focus(); + document.documentElement.contentEditable = "true"; + document.execCommand("inserthtml", false, "<table>"); + document.execCommand("indent", false, null); + document.execCommand("delete", false, null); +} +</script> +</head> +<body onload="boom();"><input id="i"></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/inserthtml-to-replace-root-list-element-in-designMode.html b/testing/web-platform/tests/editing/crashtests/inserthtml-to-replace-root-list-element-in-designMode.html new file mode 100644 index 0000000000..c751a5bebc --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/inserthtml-to-replace-root-list-element-in-designMode.html @@ -0,0 +1,33 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +document.addEventListener("DOMContentLoaded", () => { + document.execCommand("selectAll"); + const editingHost = document.querySelector("thead[contenteditable]"); + editingHost.addEventListener("focus", () => { + editingHost.addEventListener("focusout", () => { + document.execCommand("italic"); + document.execCommand("insertText", false, "A"); + document.execCommand("insertUnorderedList"); + }); + document.designMode = "on"; + document.execCommand("selectAll"); + document.execCommand("insertHTML", false, "A"); + }); + editingHost.focus(); +}); +</script> +</head> +<body> +<big> +</big> +<table> +<thead contenteditable> +</thead></table> +<p> +<object></object> +</p> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/insertimage-with-replacing-selection-in-picture-element.html b/testing/web-platform/tests/editing/crashtests/insertimage-with-replacing-selection-in-picture-element.html new file mode 100644 index 0000000000..aaae4c7c9f --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/insertimage-with-replacing-selection-in-picture-element.html @@ -0,0 +1,47 @@ +<!doctype html> +<html class="test-wait"> +<head> +<meta charset="utf-8"> +<style> +@keyframes keyframes0 {} +picture { + animation: keyframes0 300ms alternate,alternate paused; +} +ruby { + animation: keyframes0 step-start -1.5s normal backwards paused; +} +</style> +<script> +document.addEventListener("DOMContentLoaded", () => { + find("AAA") + const header = document.querySelector("header"); + addEventListener("animationend", () => { + const imgsrc = + "data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAGAAAABgCAYAAADimHc4AAAABGdBTUEAALGPC/xhBQAAAAlwSFlzAAAOxAAADsQBlSsOGwAAABh0RVh0U29mdHdhcmUAUGFpbnQuTkVUIHYzLjIyt5EXfQAAAU5JREFUeF7t07ENACAMxMDA/jsDBTtcY6TUlmx+zcx510MGNuKG/QYKgL9CAQqADWB8CygANoDxLaAA2ADGt4ACYAMY3wIKgA1gfAsoADaA8S2gANgAxreAAmADGN8CCoANYHwLKAA2gPEtoADYAMa3gAJgAxjfAgqADWB8CygANoDxLaAA2ADGt4ACYAMY3wIKgA1gfAsoADaA8S2gANgAxreAAmADGN8CCoANYHwLKAA2gPEtoADYAMa3gAJgAxjfAgqADWB8CygANoDxLaAA2ADGt4ACYAMY3wIKgA1gfAsoADaA8S2gANgAxreAAmADGN8CCoANYHwLKAA2gPEtoADYAMa3gAJgAxjfAgqADWB8CygANoDxLaAA2ADGt4ACYAMY3wIKgA1gfAsoADaA8S2gANgAxreAAmADGN8CCoANYHwLKAA2gPEtAAe4i54BvwLfXFAAAAAASUVORK5CYII="; + function doIt() { + getSelection().extend(header, 0); + document.querySelector("figure").insertAdjacentElement("beforeend", header); + document.execCommand("insertImage", false, imgsrc); + } + doIt(); + doIt(); + doIt(); + document.documentElement.removeAttribute("class"); + }, {once: true}); + document.designMode = "on"; +}, {once:true}); +</script> +</head> +<body> +<picture autocapitalize="sentences"> +<figure> +<figcaption> +</figure> +<ruby contenteditable="true"> +AAA +<header> +</header> +</ruby> +</picture> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/insertlinebreak-around-comment-node.html b/testing/web-platform/tests/editing/crashtests/insertlinebreak-around-comment-node.html new file mode 100644 index 0000000000..dc2d5e2bd4 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/insertlinebreak-around-comment-node.html @@ -0,0 +1,20 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +document.addEventListener("DOMContentLoaded", () => { + const element_0 = document.createElement("s"); + const element_1 = document.createElement("a"); + const element_2 = document.createElement("l"); + element_2.setAttribute("contenteditable", "true"); + element_1.appendChild(element_2); + element_0.appendChild(element_1); + document.documentElement.appendChild(element_0); + document.designMode = "on"; + document.execCommand("insertLineBreak"); +}); +</script> +</head> +<body><!-- COMMENT --></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/insertlinebreak-in-map-element-editing-host.html b/testing/web-platform/tests/editing/crashtests/insertlinebreak-in-map-element-editing-host.html new file mode 100644 index 0000000000..c141f89c4e --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/insertlinebreak-in-map-element-editing-host.html @@ -0,0 +1,12 @@ +<!DOCTYPE html> +<meta charset="utf-8"> +<script> + document.addEventListener("DOMContentLoaded", () => { + document.getElementById("id_0").contentEditable = false; + document.querySelector("[contenteditable]").focus(); + document.execCommand("insertLineBreak"); + }) +</script> +<pre> +<ins id="id_0"> +<map contenteditable>
\ No newline at end of file diff --git a/testing/web-platform/tests/editing/crashtests/insertorderedlist-in-focused-inline-editing-host.html b/testing/web-platform/tests/editing/crashtests/insertorderedlist-in-focused-inline-editing-host.html new file mode 100644 index 0000000000..73869af3b5 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/insertorderedlist-in-focused-inline-editing-host.html @@ -0,0 +1,23 @@ +<!DOCTYPE html> +<html class="test-wait"> +<head> +<script type="text/javascript"> + +function boom() +{ + const inlineEditingHost = document.getElementById("s"); + inlineEditingHost.addEventListener("focus", () => { + try { + document.execCommand("insertorderedlist"); + } catch(e) { } + document.documentElement.removeAttribute("class"); + }, {once: true}); + inlineEditingHost.focus(); +} + +</script> +</head> + +<body onload="boom();"><span id="s" contenteditable="true">One<div></div></span><marquee></marquee></body> + +</html> diff --git a/testing/web-platform/tests/editing/crashtests/insertorderedlist-in-text-adopted-to-other-document.html b/testing/web-platform/tests/editing/crashtests/insertorderedlist-in-text-adopted-to-other-document.html new file mode 100644 index 0000000000..e505e5bf2f --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/insertorderedlist-in-text-adopted-to-other-document.html @@ -0,0 +1,49 @@ +<!DOCTYPE html> +<html class="test-wait"> +<head> +<script> +function init1() +{ + // Create an html:iframe in HTML mode (so designMode can be used 320092) + targetIframe = document.createElementNS('http://www.w3.org/1999/xhtml', 'iframe'); + targetIframe.srcdoc = "<html></html>"; + targetIframe.setAttribute("style", "width: 700px; height: 500px; border: 1px dotted green;"); + targetIframe.addEventListener("load", init2); + document.body.appendChild(targetIframe); +} + +function init2() +{ + targetWindow = targetIframe.contentWindow; + targetDocument = targetWindow.document; + + p = document.getElementById("p"); + pText = p.firstChild; + + targetDocument.body.appendChild(targetDocument.adoptNode(p, true)); + + targetDocument.designMode = 'on'; + + setTimeout(boom, 0); +} + +function boom() +{ + var rng = targetDocument.createRange(); + rng.setStart(pText, 3); + rng.setEnd(pText, 3); + + targetWindow.getSelection().addRange(rng); + + targetDocument.execCommand("insertorderedlist", false, null); + + document.documentElement.removeAttribute("class") +} +</script> +</head> + +<body onload="init1();"> +<p id="p">word word</p> +</body> + +</html> diff --git a/testing/web-platform/tests/editing/crashtests/insertparagraph-from-DOMNodeInserted-caused-by-insertorderedlist.html b/testing/web-platform/tests/editing/crashtests/insertparagraph-from-DOMNodeInserted-caused-by-insertorderedlist.html new file mode 100644 index 0000000000..fa322420cb --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/insertparagraph-from-DOMNodeInserted-caused-by-insertorderedlist.html @@ -0,0 +1,23 @@ +<html> +<head> +<script type="text/javascript"> + +function boom() +{ + document.addEventListener("DOMNodeInserted", x); + + function x() + { + document.removeEventListener("DOMNodeInserted", x); + document.execCommand("insertParagraph", false, ""); + } + + document.execCommand("insertorderedlist", false, ""); +} + +</script> +</head> + +<body contenteditable="true" onload="boom()"></body> + +</html> diff --git a/testing/web-platform/tests/editing/crashtests/insertparagraph-in-listitem-in-svg-followed-by-collapsible-spaces.html b/testing/web-platform/tests/editing/crashtests/insertparagraph-in-listitem-in-svg-followed-by-collapsible-spaces.html new file mode 100644 index 0000000000..f5f981965b --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/insertparagraph-in-listitem-in-svg-followed-by-collapsible-spaces.html @@ -0,0 +1,28 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +addEventListener("load", () => { + document.querySelector("svg").insertAdjacentText("afterend", `\n${" ".repeat(336860180)}`); + + document.designMode = "on"; + getSelection().selectAllChildren(document.querySelector("input")); + + document.querySelector("li").appendChild(document.querySelector("p")); + document.execCommand("outdent"); + document.execCommand("insertOrderedList"); + document.execCommand("insertParagraph"); +}); +</script> +</head> +<body> +<svg> + <foreignObject> + <li></li> +/> + </foreignObject></svg><p> + <input> +</p> +<title>This test takes long time due to the long white-spaces are required</title> +</body></html> diff --git a/testing/web-platform/tests/editing/crashtests/insertparagraph-in-map-element-editing-host.html b/testing/web-platform/tests/editing/crashtests/insertparagraph-in-map-element-editing-host.html new file mode 100644 index 0000000000..e05b36907e --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/insertparagraph-in-map-element-editing-host.html @@ -0,0 +1,12 @@ +<!DOCTYPE html> +<meta charset="utf-8"> +<script> + document.addEventListener("DOMContentLoaded", () => { + document.getElementById("id_0").contentEditable = false; + document.querySelector("[contenteditable]").focus(); + document.execCommand("insertParagraph"); + }) +</script> +<pre> +<ins id="id_0"> +<map contenteditable>
\ No newline at end of file diff --git a/testing/web-platform/tests/editing/crashtests/inserttext-at-start-with-different-style.html b/testing/web-platform/tests/editing/crashtests/inserttext-at-start-with-different-style.html new file mode 100644 index 0000000000..ddd19aafd4 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/inserttext-at-start-with-different-style.html @@ -0,0 +1,20 @@ +<html> +<head> +<meta charset="utf-8"> +<head> +<script> +function go() { + a.show(); + document.execCommand("bold", false); + b.style.setProperty("font", "0px/43%"); + document.execCommand("insertText", false, "a"); +} +</script> +</head> +<body onload=go()> +<ul contenteditable="true"> +<li id="b" style="font-weight: bolder">a</li> +<dialog id="a" tabindex="0">a</dialog> +</ul> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/inserttext-with-clearing-subscript.html b/testing/web-platform/tests/editing/crashtests/inserttext-with-clearing-subscript.html new file mode 100644 index 0000000000..9c27a7ed53 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/inserttext-with-clearing-subscript.html @@ -0,0 +1,31 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +document.addEventListener("DOMContentLoaded", () => { + getSelection().collapse(document.querySelector("code[contenteditable]").firstChild, 0); + window.top.find("A"); + document.querySelector("table").insertRow(1); + document.querySelector("table").insertRow(1); + document.execCommand("subscript"); + document.execCommand("foreColor", false, "currentColor"); + document.execCommand("insertHTML", false, document.querySelector("h5").outerHTML); + document.execCommand("subscript"); + document.execCommand("foreColor", false, "currentColor"); + document.execCommand("insertHTML", false, document.querySelector("h5").outerHTML); + document.execCommand("insertText", false, "A"); +}); +</script> +</head> +<body> +<table> +<tr> +<td> +<code contenteditable> +A +<h5> +</h5> +</code> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/insertunorderedlist-in-empty-inline-editing-host.html b/testing/web-platform/tests/editing/crashtests/insertunorderedlist-in-empty-inline-editing-host.html new file mode 100644 index 0000000000..74b0993322 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/insertunorderedlist-in-empty-inline-editing-host.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="utf-8"> +<title>Test for bug 615015 of Mozilla</title> +<script> +function boom() +{ + document.getElementById("j").focus(); + try { + document.execCommand("insertunorderedlist", false, null); + } catch(e) { } +} +</script> +</head> +<body onload="boom();"><span><span contenteditable id="j"></span>T</span></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/insertunorderedlist-in-empty-table-editing-host.html b/testing/web-platform/tests/editing/crashtests/insertunorderedlist-in-empty-table-editing-host.html new file mode 100644 index 0000000000..19cc205b91 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/insertunorderedlist-in-empty-table-editing-host.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html> +<head> +<script type="text/javascript"> + +function boom() +{ + var table = document.createElement("table"); + document.body.appendChild(table); + table.contentEditable = "true"; + table.focus(); + try { + // This will throw, since it's attempting to inject a list inside a table + document.execCommand("insertunorderedlist", false, null); + } catch (e) {} +} + +</script> +</head> + +<body onload="boom();"></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/justifycenter-around-textarea.html b/testing/web-platform/tests/editing/crashtests/justifycenter-around-textarea.html new file mode 100644 index 0000000000..71d24f37b4 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/justifycenter-around-textarea.html @@ -0,0 +1,14 @@ +<!DOCTYPE html> +<meta charset="utf-8"> +<script> +function go() { + a.replaceWith(undefined) + window.getSelection().modify("move", "right", "word") + document.execCommand("justifyCenter", false) +} +</script> +<div contenteditable="true">a</div> +<textarea>23</textarea> +<li dir="RTL"> +<strong id="a"> +<svg onload="go()"> diff --git a/testing/web-platform/tests/editing/crashtests/justifycenter-then-delete-selection-on-DOMSubtreeModified.html b/testing/web-platform/tests/editing/crashtests/justifycenter-then-delete-selection-on-DOMSubtreeModified.html new file mode 100644 index 0000000000..1ee9ac35cb --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/justifycenter-then-delete-selection-on-DOMSubtreeModified.html @@ -0,0 +1,24 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +document.addEventListener("DOMContentLoaded", () => { + document.execCommand("selectAll"); + document.querySelector("li").addEventListener("DOMSubtreeModified", () => { + document.designMode = "on"; + document.execCommand("justifyCenter"); + getSelection().deleteFromDocument(); + }); + document.querySelector("li").type = "1"; +}); +</script> +</head> +<body> +<li> + <h3 align="right"> + <option contenteditable="true"></option> + </h3> +</li> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/justifyfull-selection-containing-non-editable-div-and-everything-styled-white-space-break-space.html b/testing/web-platform/tests/editing/crashtests/justifyfull-selection-containing-non-editable-div-and-everything-styled-white-space-break-space.html new file mode 100644 index 0000000000..cf199fa087 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/justifyfull-selection-containing-non-editable-div-and-everything-styled-white-space-break-space.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html> +<head> + <style> + * { + white-space: break-spaces ! important; + } + </style> + <script> + window.addEventListener('load', () => { + document.documentElement.contentEditable = true + document.execCommand('selectAll', false, null) + document.execCommand('justifyFull', false, null) + }) + </script> +</head> +<div contenteditable='false'></div> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/loading-different-page-in-iframe-while-iframe-sets-spellcheck-attr-from-load.html b/testing/web-platform/tests/editing/crashtests/loading-different-page-in-iframe-while-iframe-sets-spellcheck-attr-from-load.html new file mode 100644 index 0000000000..afddac34e1 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/loading-different-page-in-iframe-while-iframe-sets-spellcheck-attr-from-load.html @@ -0,0 +1,13 @@ +<html> +<head> +<script> +function crash() { + document.querySelector("iframe").onload = null; + document.querySelector("iframe").srcdoc = "2nd page"; +} +</script> +</head> +<body onload="crash()"> + <iframe srcdoc="<html><body onload=$quot;document.body.setAttribute('spellcheck', true);$quot;></body></html>"></iframe> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/make-editable-div-inline-and-set-contenteditable-of-input-to-false.html b/testing/web-platform/tests/editing/crashtests/make-editable-div-inline-and-set-contenteditable-of-input-to-false.html new file mode 100644 index 0000000000..1743a2641d --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/make-editable-div-inline-and-set-contenteditable-of-input-to-false.html @@ -0,0 +1,19 @@ +<!DOCTYPE html> +<html class="test-wait"> +<head> +<meta charset="utf-8"> +<title>Testcase for bug 650572 of Mozilla</title> +<script> +function boom() +{ + document.documentElement.offsetHeight; + document.body.focus(); + document.querySelector("div").style.display = "inline"; + document.querySelector("input").contentEditable = "false"; + document.documentElement.removeAttribute("class"); +} +</script> +</head> +<body contenteditable="true" onload="setTimeout(boom, 200);"><div><input></div></body> +</html> + diff --git a/testing/web-platform/tests/editing/crashtests/make-parent-element-editable-after-making-focused-editing-host-non-editable.html b/testing/web-platform/tests/editing/crashtests/make-parent-element-editable-after-making-focused-editing-host-non-editable.html new file mode 100644 index 0000000000..d624d7d3b9 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/make-parent-element-editable-after-making-focused-editing-host-non-editable.html @@ -0,0 +1,21 @@ +<html> +<head> +<script> +function boom() +{ + document.getElementById("div").contentEditable = "true"; + document.getElementById("div").focus(); + document.getElementById("div").contentEditable = "false"; + + document.getElementById("table").contentEditable = "true"; +} +</script> +</head> + +<body onload="boom();"> + +<table id="table"><td></td></table><div id="div"></div> + +</body> + +</html> diff --git a/testing/web-platform/tests/editing/crashtests/move-editing-host-to-subdocument-when-textarea-has-focus.html b/testing/web-platform/tests/editing/crashtests/move-editing-host-to-subdocument-when-textarea-has-focus.html new file mode 100644 index 0000000000..b7d2e2f902 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/move-editing-host-to-subdocument-when-textarea-has-focus.html @@ -0,0 +1,15 @@ +<script> +addEventListener("DOMContentLoaded", () => { + document.querySelector("iframe").contentDocument.body.appendChild( + document.querySelector("span") + ); + document.documentElement.style.display = "none"; +}) +</script> +<hgroup> +<audio controls> +</audio> +<iframe></iframe> +<span contenteditable></span> +</hgroup> +<textarea autofocus> diff --git a/testing/web-platform/tests/editing/crashtests/move-first-element-from-editinghost-to-outside-on-input-of-embolden.html b/testing/web-platform/tests/editing/crashtests/move-first-element-from-editinghost-to-outside-on-input-of-embolden.html new file mode 100644 index 0000000000..6bb87c2810 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/move-first-element-from-editinghost-to-outside-on-input-of-embolden.html @@ -0,0 +1,22 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +addEventListener("load", () => { + document.querySelector("ol").addEventListener("input", () => { + const inlineEditingHost = document.querySelector("span[contenteditable]"); + const iter = document.createNodeIterator(inlineEditingHost, NodeFilter.SHOW_ELEMENT); + iter.nextNode().before(inlineEditingHost); + }); + document.execCommand("selectAll"); + document.execCommand("bold"); +}); +</script> +</head> +<body> +<ol> +<span contenteditable> +<h6></h6> +</span></ol></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/move-legend-followed-by-textarea-into-orphan-div.html b/testing/web-platform/tests/editing/crashtests/move-legend-followed-by-textarea-into-orphan-div.html new file mode 100644 index 0000000000..462ff37fd6 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/move-legend-followed-by-textarea-into-orphan-div.html @@ -0,0 +1,15 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="utf-8"> +<title>Testcase for bug 667321 of Mozilla</title> +<script> +function boom() +{ + document.body.style.float = "left"; + document.createElement("div").appendChild(document.querySelector("legend")); +} +</script> +</head> +<body onload="boom();"><fieldset><legend></legend><textarea></textarea></fieldset></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/mozilla-bug-1851730.html b/testing/web-platform/tests/editing/crashtests/mozilla-bug-1851730.html new file mode 100644 index 0000000000..ee11f76792 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/mozilla-bug-1851730.html @@ -0,0 +1,11 @@ +<script> +document.addEventListener("DOMContentLoaded", () => { + document.execCommand("selectAll", false) + a.wrap = "hard" + a.value = "A" + b.style.cssFloat = "left" +}) +</script> +<textarea id="a" autofocus="autofocus">"</textarea> +<font id="b"> +<pre> diff --git a/testing/web-platform/tests/editing/crashtests/multiple-execCommand-calls-after-interting-long-text.html b/testing/web-platform/tests/editing/crashtests/multiple-execCommand-calls-after-interting-long-text.html new file mode 100644 index 0000000000..32d0e38248 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/multiple-execCommand-calls-after-interting-long-text.html @@ -0,0 +1,20 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="utf-8"> +<title>Testcase for bug 682650 of Mozilla</title> +<script> +function boom() { + document.documentElement.contentEditable = "true"; + document.execCommand("inserthtml", false, "<button><\/button>"); + document.execCommand("inserthtml", false, "i".repeat(34646)); + document.execCommand("contentReadOnly", false, null); + document.execCommand("removeformat", false, null); + document.execCommand("hilitecolor", false, "red"); + document.execCommand("inserthtml", false, "a"); + document.execCommand("delete", false, null); +} +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/non-root-editable-html-element.html b/testing/web-platform/tests/editing/crashtests/non-root-editable-html-element.html new file mode 100644 index 0000000000..2e4c02b0e1 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/non-root-editable-html-element.html @@ -0,0 +1,7 @@ +<span> +<script contenteditable="true"></script> +<blockquote> +<input> +<code style="display: table-row;"> +<html contenteditable="true"> +</blockquote> diff --git a/testing/web-platform/tests/editing/crashtests/normalize_document_at_DOMSubtreeModified_during_insertparagraph.html b/testing/web-platform/tests/editing/crashtests/normalize_document_at_DOMSubtreeModified_during_insertparagraph.html new file mode 100644 index 0000000000..a8cbaf7217 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/normalize_document_at_DOMSubtreeModified_during_insertparagraph.html @@ -0,0 +1,16 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +addEventListener("load", () => { + document.documentElement.innerHTML = "<main>\n>"; + document.addEventListener("DOMSubtreeModified", () => { + document.normalize(); + }, {capture: true}); + document.designMode = "on" + document.execCommand("insertParagraph"); +}); +</script> +</head> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/outdent-across-svg-boundary.html b/testing/web-platform/tests/editing/crashtests/outdent-across-svg-boundary.html new file mode 100644 index 0000000000..f652a2e237 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/outdent-across-svg-boundary.html @@ -0,0 +1,38 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="test-wait"> +<head> +<script> +function init() +{ + var targetWindow = window.frames[0]; + var targetDocument = targetWindow.document; + var rootish = document.getElementById('rootish'); + + targetDocument.body.appendChild(targetDocument.adoptNode(rootish)); + targetDocument.designMode = 'on'; + + targetWindow.getSelection().removeAllRanges(); + + var r = targetDocument.createRange(); + r.setStart(targetDocument.getElementById("start"), 0); + r.setEnd(targetDocument.getElementById("endparent").firstChild, 0); + targetWindow.getSelection().addRange(r); + + targetDocument.execCommand('outdent', false, null); + document.documentElement.removeAttribute("class"); +} +</script> + +</head> + +<body onload="setTimeout(init, 300);"> + +<iframe srcdoc="" style="width: 95%; height: 500px;"></iframe> + +<div id="rootish"> + <div id="start"></div> + <p>Huh</p> + <svg xmlns="http://www.w3.org/2000/svg" id="endparent"> </svg> +</div> + +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/outdent-editing-host-containing-combining-diacritical-mark.html b/testing/web-platform/tests/editing/crashtests/outdent-editing-host-containing-combining-diacritical-mark.html new file mode 100644 index 0000000000..0ed71f789b --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/outdent-editing-host-containing-combining-diacritical-mark.html @@ -0,0 +1,16 @@ +<html class="test-wait"> +<head> +<meta charset="utf-8"> +<title>Test for bug 499844 of Mozilla</title> +<script> +function boom() +{ + document.body.contentEditable = "true"; + getSelection().collapse(document.body.firstChild, 0); + document.execCommand("outdent"); + document.documentElement.removeAttribute("class"); +} +</script> +</head> +<body style="word-spacing: 3px;" onload="boom();"> ́</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/outdent-in-empty-body-editing-host.html b/testing/web-platform/tests/editing/crashtests/outdent-in-empty-body-editing-host.html new file mode 100644 index 0000000000..f68e46bc53 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/outdent-in-empty-body-editing-host.html @@ -0,0 +1,7 @@ +<html> +<head> +</head> +<body style="margin: initial;" + contenteditable="true" + onload="document.execCommand('outdent', false, null);"></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/outdent-in-meter-indented-by-legend-in-css-mode.html b/testing/web-platform/tests/editing/crashtests/outdent-in-meter-indented-by-legend-in-css-mode.html new file mode 100644 index 0000000000..af20ea8128 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/outdent-in-meter-indented-by-legend-in-css-mode.html @@ -0,0 +1,25 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +addEventListener("load", () => { + document.execCommand("styleWithCSS", false, "true"); + document.getSelection().collapse(document.querySelector("label"), 0); + document.execCommand("outdent"); +}); +</script> +</head> +<body> +<li contenteditable> +<legend style="margin-right: 43%"> +<meter> +<mi dir="rtl">8</mi> +<label> +<dir></dir> +</label> +</meter> +</legend> +</li> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/outdent-indent-inserthorizontalrule-on-selectionchange.html b/testing/web-platform/tests/editing/crashtests/outdent-indent-inserthorizontalrule-on-selectionchange.html new file mode 100644 index 0000000000..800d9d1969 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/outdent-indent-inserthorizontalrule-on-selectionchange.html @@ -0,0 +1,23 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +var count = 0; +document.addEventListener("DOMContentLoaded", () => { + document.onselectionchange = () => { + document.execCommand("outdent"); + document.execCommand("indent"); + document.execCommand("insertHorizontalRule"); + if (count++ == 10) { + document.onselectionchange = null; + } + }; + find("A"); +}); +</script> +</head> +<body><isindex contenteditable> +A +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/queryCommandIndeterm-backcolor-and-hilitecolor-in-empty-iframe-in-designMode.html b/testing/web-platform/tests/editing/crashtests/queryCommandIndeterm-backcolor-and-hilitecolor-in-empty-iframe-in-designMode.html new file mode 100644 index 0000000000..6cf2524a54 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/queryCommandIndeterm-backcolor-and-hilitecolor-in-empty-iframe-in-designMode.html @@ -0,0 +1,73 @@ +<!DOCTYPE HTML> +<html><head> + <meta charset="iso-8859-1"> + <title>Testcase for bug 448329 of Mozilla</title> +</head> +<body> + +<iframe id="frame448329"></iframe> + +<script> + +function test448329(id,cmd) { + var elm = document.getElementById(id); + var doc = elm.contentDocument; + doc.designMode = "On"; + + doc.body.offsetWidth; + var selection = doc.defaultView.getSelection(); + + // Test document node + if (selection.rangeCount > 0) { + selection.removeAllRanges(); + } + var range = doc.createRange(); + range.setStart(doc, 0); + range.setEnd(doc, 0); + selection.addRange(range); + doc.queryCommandIndeterm(cmd); + + // Test HTML node + if (selection.rangeCount > 0) { + selection.removeAllRanges(); + } + range = doc.createRange(); + range.setStart(doc.documentElement, 0); + range.setEnd(doc.documentElement, 0); + selection.addRange(range); + doc.queryCommandIndeterm(cmd); + + // Test BODY node + if (selection.rangeCount > 0) { + selection.removeAllRanges(); + } + range = doc.createRange(); + var body = doc.documentElement.childNodes[1]; + range.setStart(body, 0); + range.setEnd(body, 0); + selection.addRange(range); + doc.queryCommandIndeterm(cmd); + + var text = doc.createTextNode("Hello there"); + body.insertBefore(text, null) + + // Test TEXT node + if (selection.rangeCount > 0) { + selection.removeAllRanges(); + } + range = doc.createRange(); + range.setStart(text, 0); + range.setEnd(text, 1); + selection.addRange(range); + doc.queryCommandIndeterm(cmd); + +} + +test448329("frame448329", "backcolor") +test448329("frame448329", "hilitecolor") + +</script> + + +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/queryCommandIndeterm-backcolor-in-empty-iframe-in-designMode-from-load.html b/testing/web-platform/tests/editing/crashtests/queryCommandIndeterm-backcolor-in-empty-iframe-in-designMode-from-load.html new file mode 100644 index 0000000000..74d80e19b3 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/queryCommandIndeterm-backcolor-in-empty-iframe-in-designMode-from-load.html @@ -0,0 +1,21 @@ +<html> +<head> + <title>Testcase for bug 448329 of Mozilla</title> +<script> +function go() { + test("myFrame", "backcolor"); +} +function test(id,cmd) { + var doc = document.getElementById(id).contentDocument; + doc.designMode = "On"; + + var selection = doc.defaultView.getSelection(); + selection.removeAllRanges(); + selection.addRange(doc.createRange()); + + doc.queryCommandIndeterm(cmd); +} +</script> +</head> +<body onload="go()"><iframe id="myFrame"></iframe></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/queryCommandState-backcolor-after-removing-html-element-in-designMode-from-load.html b/testing/web-platform/tests/editing/crashtests/queryCommandState-backcolor-after-removing-html-element-in-designMode-from-load.html new file mode 100644 index 0000000000..1c8fe5db9b --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/queryCommandState-backcolor-after-removing-html-element-in-designMode-from-load.html @@ -0,0 +1,8 @@ +<html> +<BODY onload=" +document.designMode='on'; +document.removeChild(document.firstChild); +document.queryCommandState('BackColor'); +"> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/queryCommandValue-backcolor-after-replacing-html-element-with-new-one-in-designMode-from-load.html b/testing/web-platform/tests/editing/crashtests/queryCommandValue-backcolor-after-replacing-html-element-with-new-one-in-designMode-from-load.html new file mode 100644 index 0000000000..d14422c931 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/queryCommandValue-backcolor-after-replacing-html-element-with-new-one-in-designMode-from-load.html @@ -0,0 +1,8 @@ +<html> +<BODY onload=" +document.designMode='on'; +document.replaceChild(document.createElement('HTML'), document.firstChild); +document.queryCommandValue('backcolor'); +"> +</body> +</html>
\ No newline at end of file diff --git a/testing/web-platform/tests/editing/crashtests/remove-document-element-of-iframe-having-style-content.html b/testing/web-platform/tests/editing/crashtests/remove-document-element-of-iframe-having-style-content.html new file mode 100644 index 0000000000..b032311fa7 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/remove-document-element-of-iframe-having-style-content.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="utf-8"> +<title>Testcase for bug 643706 of Mozilla</title> +<script> +function boom() { + const iframe = document.querySelector("iframe"); + const win = iframe.contentWindow; + win.document.designMode = 'on'; + iframe.style.content = "'m'"; + win.document.removeChild(win.document.documentElement) +} +</script> +</head> +<body onload="boom();"><iframe srcdoc=""></iframe></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/remove-editing-host-during-forwarddelete.html b/testing/web-platform/tests/editing/crashtests/remove-editing-host-during-forwarddelete.html new file mode 100644 index 0000000000..6013361ccb --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/remove-editing-host-during-forwarddelete.html @@ -0,0 +1,65 @@ +<!doctype html> +<html class="test-wait"> +<head> +<meta charset="utf-8"> +<style> +dir { + animation: kf, 0s infinite paused; +} +svg { + animation-name: kf; +} +@keyframes kf {} +</style> +<script> +let dir; +// animationend for <svg> and <dir> may be fired before "DOMContentLoaded". +// Therefore, let's start to listen them immediately. +const waitForAnimationEnd = new Promise(resolve => { + let count = 0; + function onAnimationEnd() { + window.find("AAAAAAAAAA"); + document.execCommand("forwardDelete"); + count++; + function getRemainingEventCount(event) { + if (count >= 2) { + return 0; + } + if (event.target.tagName == "DIR") { + return 0; + } + // If `animationend` is delayed and `<dir>` has already been removed, + // `animationend` for it is never fired anymore. + return dir && !dir.isConnected ? 0 : 1; + } + if (!getRemainingEventCount()) { + window.removeEventListener("animationend", onAnimationEnd); + resolve(); + } + } + window.addEventListener("animationend", onAnimationEnd); +}); + +document.addEventListener("DOMContentLoaded", async () => { + dir = document.querySelector("dir"); + window.find("A"); + document.execCommand("insertHTML", false, "AAAAAAAAAAAAAAAA"); + dir.addEventListener("DOMNodeRemoved", event => { + dir.remove(); + }); + window.find("A"); + document.execCommand("delete"); + await waitForAnimationEnd; + document.documentElement.removeAttribute("class"); +}); +</script> +</head> +<body> +<svg> +<s></s> +<dir contenteditable> +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +</dir> +</svg> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/remove-editing-host-on-DOMNodeInserted-at-indent.html b/testing/web-platform/tests/editing/crashtests/remove-editing-host-on-DOMNodeInserted-at-indent.html new file mode 100644 index 0000000000..22e8fd0713 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/remove-editing-host-on-DOMNodeInserted-at-indent.html @@ -0,0 +1,24 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +document.addEventListener("DOMContentLoaded", () => { + const editingHost = document.querySelector("h6[contenteditable]"); + document.querySelector("wbr").addEventListener( + "DOMNodeInserted", + () => editingHost.remove() + ); + window.find("A"); + document.execCommand("indent"); +}) +</script> +</head> +<body> +<h6 contenteditable> +<time> +<wbr> +<main></main> +A +</time></h6></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/remove-editing-host-which-is-selected.html b/testing/web-platform/tests/editing/crashtests/remove-editing-host-which-is-selected.html new file mode 100644 index 0000000000..06ee6dc505 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/remove-editing-host-which-is-selected.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<meta charset="utf-8"> +<script> +window.onload = () => { + let s = window.getSelection() + let r = document.createRange() + r.selectNode(document.getElementById('b')) + s.addRange(r) + r = document.createRange() + r.selectNode(document.getElementById('a')) + s.addRange(r) + document.documentElement.innerHTML = '' +} +</script> +<body id='a' contenteditable='true'> +<canvas tabindex='0'> +<audio id='b'> diff --git a/testing/web-platform/tests/editing/crashtests/remove-iframe-for-designMode.html b/testing/web-platform/tests/editing/crashtests/remove-iframe-for-designMode.html new file mode 100644 index 0000000000..609a9ca542 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/remove-iframe-for-designMode.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="utf-8"> +<title>Test for bug 612565 of Mozilla</title> +</head> + <body> + <iframe></iframe> + </body> + <script> + onload = function() { + var i = document.querySelector("iframe"); + var doc = i.contentDocument; + doc.body.appendChild(doc.createTextNode("foo")); + doc.designMode = "on"; + while (doc.body.firstChild) { + doc.body.firstChild.remove(); + } + }; + </script> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/remove-parent-element-during-inserthtml.html b/testing/web-platform/tests/editing/crashtests/remove-parent-element-during-inserthtml.html new file mode 100644 index 0000000000..3a0cf1c957 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/remove-parent-element-during-inserthtml.html @@ -0,0 +1,24 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +document.addEventListener("DOMContentLoaded", () => { + document.onselectionchange = () => { + document.execCommand("insertHTML", false, "a") + document.designMode = "on" + }; + window.find("a"); + document.querySelector("dl[contenteditable] > dd").addEventListener("DOMNodeRemoved", () => { + document.querySelector("dl[contenteditable]").remove(); + }); +}); +</script> +</head> +<body> +<dl contenteditable> +<dd></dd> +a +</dl> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/remove-right-block-during-joining-with-parent-left-block.html b/testing/web-platform/tests/editing/crashtests/remove-right-block-during-joining-with-parent-left-block.html new file mode 100644 index 0000000000..29ee228fea --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/remove-right-block-during-joining-with-parent-left-block.html @@ -0,0 +1,33 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<title>Test removing right block while joining it and parent left block</title> +<script> +addEventListener("load", () => { + const editingHosts = document.querySelectorAll("div[contenteditable]"); + for (const editingHost of editingHosts) { + editingHost.focus(); + const rightChildBlock = editingHost.querySelector("div > div > div"); + getSelection().collapse(rightChildBlock.firstChild.firstChild, 0); + editingHost.addEventListener("DOMSubtreeModified", () => { + document.body.appendChild(rightChildBlock); + }); + document.execCommand("delete"); + } +}); +</script> +</head> +<body> + <div contenteditable> + <div>parent<div><b>child</b></div>parent</div> + </div> + <div contenteditable> + <div>parent<div><b>child<br>2nd line</b></div>parent</div> + </div> + <div contenteditable style="white-space:pre"> + <div>parent<div>child +2nd line</div>parent</div> + </div> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/removeformat-from-DOMNodeRemoved.html b/testing/web-platform/tests/editing/crashtests/removeformat-from-DOMNodeRemoved.html new file mode 100644 index 0000000000..3f78f99436 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/removeformat-from-DOMNodeRemoved.html @@ -0,0 +1,29 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +document.addEventListener("DOMContentLoaded", () => { + window.find("a"); + document.addEventListener("DOMNodeRemoved", () => { + try { + document.getElementById("target").normalize(); + document.execCommand("removeFormat"); + } catch (e) { + } + }); + document.adoptNode(document.querySelector("datalist")); +}); +</script> +</head> +<body> +<kbd> +<datalist> +</kbd> +<figcaption contenteditable> +<font id="target"> +a +</font> +</figcaption> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/removeformat-in-number-input-immediately-after-type-change-and-stepUp.html b/testing/web-platform/tests/editing/crashtests/removeformat-in-number-input-immediately-after-type-change-and-stepUp.html new file mode 100644 index 0000000000..d83c2e0079 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/removeformat-in-number-input-immediately-after-type-change-and-stepUp.html @@ -0,0 +1,20 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +document.addEventListener("DOMContentLoaded", () => { + const input = document.querySelector("input"); + input.select(); + input.type = "number"; + document.querySelector("switch").scrollIntoView(true); + input.stepUp(1); + document.execCommand("removeFormat"); +}); +</script> +</head> +<body> +<input> +<switch> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/remve-documentElement-after-inserthtml-svg-and-td.html b/testing/web-platform/tests/editing/crashtests/remve-documentElement-after-inserthtml-svg-and-td.html new file mode 100644 index 0000000000..eebeac317d --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/remve-documentElement-after-inserthtml-svg-and-td.html @@ -0,0 +1,15 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="utf-8"> +<script> +addEventListener("load", () => { + document.querySelector("div[contenteditable]").focus(); + document.execCommand("inserthtml", false, "<svg><td>"); + document.documentElement.remove(); +}); +</script> +</head> + +<body><div contenteditable></div></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/replace-document-root-with-object-and-mo.html b/testing/web-platform/tests/editing/crashtests/replace-document-root-with-object-and-mo.html new file mode 100644 index 0000000000..bdad541422 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/replace-document-root-with-object-and-mo.html @@ -0,0 +1,19 @@ +<!DOCTYPE html> +<html> +<head> +<script> +addEventListener("load", () => { + const object = document.querySelector("object[contenteditable]"); + const mo = object.querySelector("mo"); + const range = new Range(); + document.replaceChildren(); + range.insertNode(object); + object.replaceChild(mo, object.firstChild); +}); +</script> +</head> +<object contenteditable> + <mo> + </mo> +</object> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/replace-parent-of-editing-host-on-DOMSubtreeModified.html b/testing/web-platform/tests/editing/crashtests/replace-parent-of-editing-host-on-DOMSubtreeModified.html new file mode 100644 index 0000000000..9d431aa860 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/replace-parent-of-editing-host-on-DOMSubtreeModified.html @@ -0,0 +1,28 @@ +<!doctype html> +<html> +<head> +<script> +document.addEventListener("DOMContentLoaded", () => { + getSelection().collapse(document.querySelector("content"), 1); + document.querySelector("div[contenteditable]").addEventListener("DOMSubtreeModified", () => { + document.querySelector("tr").replaceChild( + document.querySelector("meter"), + document.querySelector("th") + ); + }); + document.execCommand("justifyFull"); +}); +</script> +</head> +<body> +<table> +<tr> +<th> +<div contenteditable> +<meter> +<content> +<ul></ul> +</div> +</th></tr></table> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/selectall-and-inerthtml-in-textarea-editing-host.html b/testing/web-platform/tests/editing/crashtests/selectall-and-inerthtml-in-textarea-editing-host.html new file mode 100644 index 0000000000..8b0e36cd65 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/selectall-and-inerthtml-in-textarea-editing-host.html @@ -0,0 +1,15 @@ +<html> +<head> +<script type="text/javascript"> + +function boom() +{ + document.execCommand("selectAll", false, null); + document.execCommand("inserthtml", false, "<p>"); +} + +</script> +</head> + +<body onload="boom();"><textarea contenteditable="true"></textarea></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/selectall-in-head-editing-host-after-body-removed.html b/testing/web-platform/tests/editing/crashtests/selectall-in-head-editing-host-after-body-removed.html new file mode 100644 index 0000000000..786ea25d9a --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/selectall-in-head-editing-host-after-body-removed.html @@ -0,0 +1,19 @@ +<html><head><script type="text/javascript"> + +function boom() +{ + var dE = document.documentElement; + var head = document.getElementsByTagName("head")[0]; + dE.removeChild(document.body); + dE.contentEditable = "true"; + dE.focus(); + dE.contentEditable = "false"; + head.focus(); + head.contentEditable = "true"; + try { + document.execCommand("selectAll", false, ""); + } catch(e) { + } +} + +</script></head><body onload="boom();"></body></html>
\ No newline at end of file diff --git a/testing/web-platform/tests/editing/crashtests/selectall-selection-modify-move-forward-lineboundary-selectall-around-editable-canvas.html b/testing/web-platform/tests/editing/crashtests/selectall-selection-modify-move-forward-lineboundary-selectall-around-editable-canvas.html new file mode 100644 index 0000000000..8e57700af5 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/selectall-selection-modify-move-forward-lineboundary-selectall-around-editable-canvas.html @@ -0,0 +1,12 @@ +<!DOCTYPE html> +<meta charset="utf-8"> +<script> +onload = () => { + document.querySelector("canvas[contenteditable]").blur(); + document.execCommand("selectAll", false); + getSelection().modify("move", "forward", "lineboundary"); + document.execCommand("selectAll", false); +}; +</script> +<canvas contenteditable="true"> +<audio controls> diff --git a/testing/web-platform/tests/editing/crashtests/selection-modify-around-input-in-contenteditable.html b/testing/web-platform/tests/editing/crashtests/selection-modify-around-input-in-contenteditable.html new file mode 100644 index 0000000000..90b615da5c --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/selection-modify-around-input-in-contenteditable.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="utf-8"> +<script> +addEventListener("load", () => { + const selection = window.getSelection(); + const range = selection.getRangeAt(0); + selection.modify("move", "backward", "character"); + selection.addRange(range); +}); +</script> +</head> +<body> +<fieldset contenteditable spellcheck="true"> + <input value="x"> + <table> + <caption></caption> + </table> +</fieldset> +</body> +</html>
\ No newline at end of file diff --git a/testing/web-platform/tests/editing/crashtests/selection-modify-extend-backward-character-to-outside-body-in-designMode.html b/testing/web-platform/tests/editing/crashtests/selection-modify-extend-backward-character-to-outside-body-in-designMode.html new file mode 100644 index 0000000000..9f465cc462 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/selection-modify-extend-backward-character-to-outside-body-in-designMode.html @@ -0,0 +1,10 @@ +<!DOCTYPE html> +<meta charset="utf-8"> +<script> +onload = () => { + document.designMode = 'on'; + getSelection().selectAllChildren(document.body); + getSelection().modify('extend', 'backward', 'character'); +}; +</script> +<audio controls> diff --git a/testing/web-platform/tests/editing/crashtests/set-input-value-of-editing-host-after-changing-type.html b/testing/web-platform/tests/editing/crashtests/set-input-value-of-editing-host-after-changing-type.html new file mode 100644 index 0000000000..34a1558896 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/set-input-value-of-editing-host-after-changing-type.html @@ -0,0 +1,15 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +document.addEventListener("DOMContentLoaded", () => { + const input = document.querySelector("input"); + input.focus(); + input.type = "text"; + input.value = "new value"; +}, {once: true}); +</script> +</head> +<body><input type="button" contenteditable></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/set-output-value-to-empty-while-deleting-its-content.html b/testing/web-platform/tests/editing/crashtests/set-output-value-to-empty-while-deleting-its-content.html new file mode 100644 index 0000000000..6ddf89205f --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/set-output-value-to-empty-while-deleting-its-content.html @@ -0,0 +1,33 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +document.addEventListener("DOMContentLoaded", () => { + document.designMode = "on"; + window.find("AA"); + document.addEventListener( + "selectionchange", + onSelectionChangeOrDOMNodeInserted, + {once: true} + ); + document.querySelector("output").addEventListener( + "DOMNodeInserted", + onSelectionChangeOrDOMNodeInserted + ); + document.execCommand("forwarddelete"); +}); + +function onSelectionChangeOrDOMNodeInserted() { + document.execCommand("delete"); + document.querySelector("output").value = ""; +} +</script> +</head> +<body> +<output> +<ruby></ruby> +<div> +AAA +</div></output></body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/set-selection-range-after-updating-textarea-default-value.html b/testing/web-platform/tests/editing/crashtests/set-selection-range-after-updating-textarea-default-value.html new file mode 100644 index 0000000000..421306fc96 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/set-selection-range-after-updating-textarea-default-value.html @@ -0,0 +1,16 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<script> +addEventListener("load", () => { + const textarea = document.createElement("textarea"); + document.documentElement.appendChild(textarea); + textarea.focus(); + textarea.dir = "rtl"; + textarea.prepend("0123456789A", document.createElement("marquee")); + textarea.setSelectionRange(8, 13, ""); +}); +</script> +</head> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/support/unloading-editor-in-subdocument-containing-misspelled-word-iframe.html b/testing/web-platform/tests/editing/crashtests/support/unloading-editor-in-subdocument-containing-misspelled-word-iframe.html new file mode 100644 index 0000000000..cfedfa8d2e --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/support/unloading-editor-in-subdocument-containing-misspelled-word-iframe.html @@ -0,0 +1 @@ +<html><meta charset="utf-8"><body><textarea>notaword</textarea></body></html> diff --git a/testing/web-platform/tests/editing/crashtests/textarea-will-be-blurred-by-focus-event-listener.html b/testing/web-platform/tests/editing/crashtests/textarea-will-be-blurred-by-focus-event-listener.html new file mode 100644 index 0000000000..bcb145c309 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/textarea-will-be-blurred-by-focus-event-listener.html @@ -0,0 +1,16 @@ +<!DOCTYPE html> +<html class="test-wait"> +<meta charset="utf-8"> +<script> +addEventListener("load", () => { + const textarea = document.querySelector("textarea"); + textarea.addEventListener("focus", () => { + textarea.select(); + textarea.parentElement.setAttribute("hidden", "hidden"); + setTimeout(() => document.documentElement.removeAttribute("class"), 0); + }); + textarea.focus(); +}); +</script> +<div><textarea>abc</textarea></div> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/unloading-editor-in-subdocument-containing-misspelled-word.html b/testing/web-platform/tests/editing/crashtests/unloading-editor-in-subdocument-containing-misspelled-word.html new file mode 100644 index 0000000000..1b90e1d56a --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/unloading-editor-in-subdocument-containing-misspelled-word.html @@ -0,0 +1,11 @@ +<html class="test-wait"> +<head> +<meta charset="utf-8"> +<title>Test case for bug 459613 of Mozilla</title> +</head> +<body> +<iframe + srcdoc="support/unloading-editor-in-subdocument-containing-misspelled-word-iframe.html" + onload="document.documentElement.removeAttribute('class')"></iframe> +</body> +</html> diff --git a/testing/web-platform/tests/editing/crashtests/update-dom-during-undoing-in-textarea.html b/testing/web-platform/tests/editing/crashtests/update-dom-during-undoing-in-textarea.html new file mode 100644 index 0000000000..56f7f82a21 --- /dev/null +++ b/testing/web-platform/tests/editing/crashtests/update-dom-during-undoing-in-textarea.html @@ -0,0 +1,32 @@ +<!doctype html> +<html> +<head> +<meta charset="utf-8"> +<title>Test for updating the DOM tree while execCommand("undo") is running in the textarea</title> +<script> +"use strict"; + +let count = 0; +addEventListener("load", () => { + document.execCommand("insertText", false, "F"); + document.execCommand("undo"); +}); + +function onInputOfTextarea() { + if (count) { + document.querySelector("base").appendChild( + document.querySelector("content") + ); + } + count++; +} +</script> +</head> +<body> +<iframe></iframe> +<textarea autofocus oninput="onInputOfTextarea()">a</textarea> +<base></base> +<content> +<menu> +</body> +</html> |