summaryrefslogtreecommitdiffstats
path: root/accessible/tests/crashtests
diff options
context:
space:
mode:
Diffstat (limited to 'accessible/tests/crashtests')
-rw-r--r--accessible/tests/crashtests/1072792.xhtml5
-rw-r--r--accessible/tests/crashtests/1380199.html15
-rw-r--r--accessible/tests/crashtests/1402999.html11
-rw-r--r--accessible/tests/crashtests/1415667.html1
-rw-r--r--accessible/tests/crashtests/1463962.html4
-rw-r--r--accessible/tests/crashtests/1472024-1.html7
-rw-r--r--accessible/tests/crashtests/1472024-2.html20
-rw-r--r--accessible/tests/crashtests/1484778.html26
-rw-r--r--accessible/tests/crashtests/1494707.html15
-rw-r--r--accessible/tests/crashtests/1503964.html4
-rw-r--r--accessible/tests/crashtests/1572811.html9
-rw-r--r--accessible/tests/crashtests/1578282.html21
-rw-r--r--accessible/tests/crashtests/1585851.html21
-rw-r--r--accessible/tests/crashtests/1655983.html6
-rw-r--r--accessible/tests/crashtests/1838250.html6
-rw-r--r--accessible/tests/crashtests/448064.xhtml70
-rw-r--r--accessible/tests/crashtests/884202.html21
-rw-r--r--accessible/tests/crashtests/890760.html14
-rw-r--r--accessible/tests/crashtests/893515.html15
-rw-r--r--accessible/tests/crashtests/crashtests.list23
-rw-r--r--accessible/tests/crashtests/last_test_to_unload_testsuite.xhtml36
21 files changed, 350 insertions, 0 deletions
diff --git a/accessible/tests/crashtests/1072792.xhtml b/accessible/tests/crashtests/1072792.xhtml
new file mode 100644
index 0000000000..f99c64c5d3
--- /dev/null
+++ b/accessible/tests/crashtests/1072792.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body onload="document.body.appendChild(x);">
+<table><tbody><div id="x"></div></tbody></table>
+</body>
+</html>
diff --git a/accessible/tests/crashtests/1380199.html b/accessible/tests/crashtests/1380199.html
new file mode 100644
index 0000000000..c690597173
--- /dev/null
+++ b/accessible/tests/crashtests/1380199.html
@@ -0,0 +1,15 @@
+<script>
+window.onload=function(){
+ let o=document.getElementById('a');
+ let n=document.createElement('plaintext');
+ o.parentNode.replaceChild(n,o);
+ n.setAttribute('id','a');
+ document.getElementById('a').setAttribute('aria-owns','c b');
+ document.getElementById('d').setAttribute('width',1);
+}
+</script>
+>
+<script id='a'></script>
+<hgroup id='b'>
+<h6 id='c'>
+<video id='d' controls width='169' height='187'>
diff --git a/accessible/tests/crashtests/1402999.html b/accessible/tests/crashtests/1402999.html
new file mode 100644
index 0000000000..567f20b2df
--- /dev/null
+++ b/accessible/tests/crashtests/1402999.html
@@ -0,0 +1,11 @@
+<script>
+document.addEventListener("DOMContentLoaded", function(){
+ document.getElementById('a').click();
+ window.frames[0].document.body.appendChild(document.getElementById('b'));
+});
+</script>
+<cite id='b'>
+<label>
+<input/>
+<strong id='a'></strong>
+<iframe>
diff --git a/accessible/tests/crashtests/1415667.html b/accessible/tests/crashtests/1415667.html
new file mode 100644
index 0000000000..174099837d
--- /dev/null
+++ b/accessible/tests/crashtests/1415667.html
@@ -0,0 +1 @@
+<iframe role="row">
diff --git a/accessible/tests/crashtests/1463962.html b/accessible/tests/crashtests/1463962.html
new file mode 100644
index 0000000000..c3d233af5c
--- /dev/null
+++ b/accessible/tests/crashtests/1463962.html
@@ -0,0 +1,4 @@
+<style>
+#a { display: contents }
+</style>
+<li id="a">
diff --git a/accessible/tests/crashtests/1472024-1.html b/accessible/tests/crashtests/1472024-1.html
new file mode 100644
index 0000000000..2b745a635e
--- /dev/null
+++ b/accessible/tests/crashtests/1472024-1.html
@@ -0,0 +1,7 @@
+<style>
+.a { position: absolute }
+</style>
+<table>
+<tbody class="a">
+<tr>b</tr>
+<th>
diff --git a/accessible/tests/crashtests/1472024-2.html b/accessible/tests/crashtests/1472024-2.html
new file mode 100644
index 0000000000..74719cb91a
--- /dev/null
+++ b/accessible/tests/crashtests/1472024-2.html
@@ -0,0 +1,20 @@
+<html class="reftest-wait">
+<script>
+function tweak() {
+ document.getElementById('a').appendChild(document.createTextNode('hZ'));
+ document.documentElement.removeAttribute("class");
+}
+
+window.onload = () => {
+ // double-rAF (to ensure layout/paints have been flushed) before we make
+ // the dynamic modification. This seems to make the bug more likely to
+ // reproduce, in unpatched builds.
+ requestAnimationFrame(() => { requestAnimationFrame(() => {
+ tweak();
+ }); });
+};
+</script>
+<table>
+<tfoot id='a'>
+<th>
+<textarea>Text
diff --git a/accessible/tests/crashtests/1484778.html b/accessible/tests/crashtests/1484778.html
new file mode 100644
index 0000000000..9d3fc33f59
--- /dev/null
+++ b/accessible/tests/crashtests/1484778.html
@@ -0,0 +1,26 @@
+<style>
+#a { border-left: solid -moz-hyperlinktext 93em }
+</style>
+<script>
+/*
+ I dont't know why but this seems to be required to trigger the crash...
+ aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+ aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+ aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+ aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+ aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+ aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+ aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+ aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+ aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+ aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+ aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+*/
+function go() {
+ var b = document.elementFromPoint(0,0);
+ window.scroll({left: 97, top: -1});
+ document.adoptNode(b);
+}
+</script>
+<body onload=go()>
+<ins id="a">
diff --git a/accessible/tests/crashtests/1494707.html b/accessible/tests/crashtests/1494707.html
new file mode 100644
index 0000000000..f2feb1572d
--- /dev/null
+++ b/accessible/tests/crashtests/1494707.html
@@ -0,0 +1,15 @@
+<html>
+ <head>
+ <style>
+ *::after {
+ content: counters(bar, '', none);
+ }
+ </style>
+ </head>
+ <body>
+ <table>
+ <thead></thead>
+ <th></th>
+ </table>
+ </body>
+</html>
diff --git a/accessible/tests/crashtests/1503964.html b/accessible/tests/crashtests/1503964.html
new file mode 100644
index 0000000000..bc4c359b52
--- /dev/null
+++ b/accessible/tests/crashtests/1503964.html
@@ -0,0 +1,4 @@
+<table>
+<th>X</th>
+<tfoot style="display: table-row">
+<tr role="columnheader">X</tr>
diff --git a/accessible/tests/crashtests/1572811.html b/accessible/tests/crashtests/1572811.html
new file mode 100644
index 0000000000..61dc78ca7b
--- /dev/null
+++ b/accessible/tests/crashtests/1572811.html
@@ -0,0 +1,9 @@
+<script>
+function go() {
+ a.style.overflow = "auto";
+}
+</script>
+<body onload=go()>
+<table id="a" background="3">
+<th>
+<textarea style="position:absolute">A</textarea>
diff --git a/accessible/tests/crashtests/1578282.html b/accessible/tests/crashtests/1578282.html
new file mode 100644
index 0000000000..31cc1ce02b
--- /dev/null
+++ b/accessible/tests/crashtests/1578282.html
@@ -0,0 +1,21 @@
+<html class="reftest-wait">
+<head>
+<script>
+function onload() {
+ document.documentElement.style.display = "none"
+ document.documentElement.getBoundingClientRect()
+ document.documentElement.style.display = ""
+ window.setTimeout(() => {
+ document.documentElement.removeAttribute("class");
+ }, 1000);
+}
+</script>
+</head>
+<body onload="onload()">
+<marquee style="display: inline-grid">
+<video></video>
+<bgsound></bgsound>
+&lt;
+</marquee>
+</body>
+</html> \ No newline at end of file
diff --git a/accessible/tests/crashtests/1585851.html b/accessible/tests/crashtests/1585851.html
new file mode 100644
index 0000000000..3acac2de7d
--- /dev/null
+++ b/accessible/tests/crashtests/1585851.html
@@ -0,0 +1,21 @@
+<style>
+* {
+ border-collapse: collapse;
+}
+</style>
+<script>
+window.onload = () => {
+ c.style.setProperty("border-collapse", "separate")
+}
+function eh() {
+ a.options.add(f)
+ a.add(b, 9)
+ a.add(f, d)
+}
+</script>
+<select id="a"></select>
+<option id="b">
+<dd id="c">
+<audio id="d" controls>
+<details open="true" ontoggle="eh()">
+<optgroup id="f">
diff --git a/accessible/tests/crashtests/1655983.html b/accessible/tests/crashtests/1655983.html
new file mode 100644
index 0000000000..88fee3ec5d
--- /dev/null
+++ b/accessible/tests/crashtests/1655983.html
@@ -0,0 +1,6 @@
+<script>
+ document.addEventListener('DOMContentLoaded', () => {
+ document.getElementById('id_0').type = ''
+ })
+</script>
+<input id="id_0" type="time">
diff --git a/accessible/tests/crashtests/1838250.html b/accessible/tests/crashtests/1838250.html
new file mode 100644
index 0000000000..3ae4957733
--- /dev/null
+++ b/accessible/tests/crashtests/1838250.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<div style="writing-mode:vertical-rl">
+ foo
+ <span style="text-combine-upright: all">abc</span>
+ bar
+</div>
diff --git a/accessible/tests/crashtests/448064.xhtml b/accessible/tests/crashtests/448064.xhtml
new file mode 100644
index 0000000000..c1a25ca550
--- /dev/null
+++ b/accessible/tests/crashtests/448064.xhtml
@@ -0,0 +1,70 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body>
+<div id="mw_b">
+<div id="mw_f">
+<div id="mw_g" style="display: none;"/>
+</div>
+</div>
+
+<div id="mw_c" style="display: none;">
+<div id="mw_d">
+<div id="mw_e"></div>
+</div>
+</div>
+
+<input id="mw_a"/>
+
+
+<script>
+function dumpAccessibleNode(aNode, level) {
+ var msg = "";
+
+ try {
+ msg += "name=\"" + aNode.name + "\" ";
+ } catch (e) {
+ msg += " noName ";
+ }
+
+ dump(msg + "\n");
+}
+
+
+function dumpAccessibleTree(aNode, level) {
+ level = level || 0;
+
+ dumpAccessibleNode(aNode, level);
+ try {
+ var child = aNode.firstChild;
+ while (child) {
+ dumpAccessibleTree(child, level + 1);
+ child = child.nextSibling;
+ }
+ } catch (e) {
+ dump("Error visiting child nodes: " + e + "\n");
+ }
+}
+
+function A(o) {
+ var acc = SpecialPowers.Cc["@mozilla.org/accessibilityService;1"]
+ .getService(SpecialPowers.Ci.nsIAccessibilityService);
+ return acc.getAccessibleFor(o);
+}
+
+function beginAccessible() {
+ dumpAccessibleTree(A(document), 0);
+}
+setTimeout(beginAccessible, 100);
+
+
+setTimeout(doe, 200);
+function doe() {
+ document.getElementById("mw_a").appendChild(document.getElementById("mw_b"));
+ document.getElementById("mw_c").appendChild(document.getElementById("mw_d"));
+ document.getElementById("mw_e").appendChild(document.getElementById("mw_f"));
+ document.getElementById("mw_g").appendChild(document.getElementById("mw_b"));
+}
+</script>
+</body>
+</html>
diff --git a/accessible/tests/crashtests/884202.html b/accessible/tests/crashtests/884202.html
new file mode 100644
index 0000000000..f29ef55f4a
--- /dev/null
+++ b/accessible/tests/crashtests/884202.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function f()
+{
+ window.removeEventListener("pagehide", f, false);
+ var root = document.documentElement;
+ document.removeChild(root);
+ document.appendChild(root);
+}
+
+function boom()
+{
+ window.addEventListener("pagehide", f, false);
+ window.location = "data:text/html,4";
+}
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/accessible/tests/crashtests/890760.html b/accessible/tests/crashtests/890760.html
new file mode 100644
index 0000000000..ecc76160b9
--- /dev/null
+++ b/accessible/tests/crashtests/890760.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ window.getSelection().collapse(document.createTextNode("."), 0);
+}
+
+</script>
+</head>
+<body onload="setTimeout(boom, 0);"></body>
+</html>
diff --git a/accessible/tests/crashtests/893515.html b/accessible/tests/crashtests/893515.html
new file mode 100644
index 0000000000..a9cc12c928
--- /dev/null
+++ b/accessible/tests/crashtests/893515.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+function boom()
+{
+ document.designMode = 'on';
+ var otherDoc = document.implementation.createDocument("", "", null);
+ otherDoc.adoptNode(document.getElementById("t"));
+}
+</script>
+</head>
+<body onload="setTimeout(boom, 0);"><textarea id="t"></textarea></body>
+</html>
diff --git a/accessible/tests/crashtests/crashtests.list b/accessible/tests/crashtests/crashtests.list
new file mode 100644
index 0000000000..2f628ddfe2
--- /dev/null
+++ b/accessible/tests/crashtests/crashtests.list
@@ -0,0 +1,23 @@
+load 448064.xhtml # This test instantiates a11y, so be careful about adding tests before it
+asserts-if(!browserIsRemote,2) load 884202.html
+load 1572811.html
+load 1578282.html
+load 890760.html
+load 893515.html
+load 1072792.xhtml
+load 1380199.html
+load 1402999.html
+load 1463962.html
+load 1472024-1.html
+load 1472024-2.html
+load 1484778.html
+load 1494707.html
+load 1503964.html
+load 1415667.html
+load 1585851.html
+load 1655983.html
+load 1838250.html
+
+# last_test_to_unload_testsuite.xhtml MUST be the last test in the list because it
+# is responsible for shutting down accessibility service affecting later tests.
+load chrome://reftest/content/crashtests/accessible/tests/crashtests/last_test_to_unload_testsuite.xhtml
diff --git a/accessible/tests/crashtests/last_test_to_unload_testsuite.xhtml b/accessible/tests/crashtests/last_test_to_unload_testsuite.xhtml
new file mode 100644
index 0000000000..9a70c41dcf
--- /dev/null
+++ b/accessible/tests/crashtests/last_test_to_unload_testsuite.xhtml
@@ -0,0 +1,36 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ title="bug 471493 'crash [@ nsPropertyTable::GetPropertyInternal]'"
+ onload="shutdown();" class="reftest-wait">
+
+ <script type="application/javascript">
+ <![CDATA[
+ function shutdown() {
+ !SpecialPowers.Services.appinfo.accessibilityEnabled &&
+ dump("### Error : Accessibility is expected to be enabled.\n");
+
+ // Force garbage collection. We try really hard to garbage collect
+ // everythin here to ensure that all a11y xpcom bits are shut down and
+ // avoid intermittent timeouts.
+ SpecialPowers.gc();
+ SpecialPowers.forceShrinkingGC();
+ SpecialPowers.forceCC();
+ SpecialPowers.gc();
+ SpecialPowers.forceShrinkingGC();
+ SpecialPowers.forceCC();
+
+ if (SpecialPowers.Services.appinfo.accessibilityEnabled) {
+ let observe = (subject, topic, data) => {
+ SpecialPowers.Services.obs.removeObserver(observe, "a11y-init-or-shutdown");
+ data === "0" && document.documentElement.removeAttribute("class");
+ };
+ SpecialPowers.Services.obs.addObserver(observe, "a11y-init-or-shutdown");
+ } else {
+ document.documentElement.removeAttribute("class");
+ }
+ }
+ ]]>
+ </script>
+</window>