diff options
Diffstat (limited to 'dom/events/crashtests')
20 files changed, 266 insertions, 0 deletions
diff --git a/dom/events/crashtests/1033343.html b/dom/events/crashtests/1033343.html new file mode 100644 index 0000000000..99160cebff --- /dev/null +++ b/dom/events/crashtests/1033343.html @@ -0,0 +1,5 @@ +<script> + +document.createEvent('CustomEvent').detail; + +</script> diff --git a/dom/events/crashtests/1035654-1.html b/dom/events/crashtests/1035654-1.html new file mode 100644 index 0000000000..6e3e3c0270 --- /dev/null +++ b/dom/events/crashtests/1035654-1.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html> + +<head> +<script> + +function boom() +{ + var video = document.createElement('video'); + var track = video.addTextTrack('chapters'); + window.meep = new TrackEvent("t", { "track": track }); + document.documentElement.style.expando = null; +} + +</script> +</head> + +<body onload="boom();"> +</body> + +</html> diff --git a/dom/events/crashtests/1035654-2.html b/dom/events/crashtests/1035654-2.html new file mode 100644 index 0000000000..19f5a1cc89 --- /dev/null +++ b/dom/events/crashtests/1035654-2.html @@ -0,0 +1,20 @@ +<!DOCTYPE html> +<html> + +<head> +<script> + +function boom() +{ + var video = document.createElement('video'); + var track = video.addTextTrack('chapters'); + track.expando = new TrackEvent("t", { "track": track }) +} + +</script> +</head> + +<body onload="boom();"> +</body> + +</html> diff --git a/dom/events/crashtests/104310-1.html b/dom/events/crashtests/104310-1.html new file mode 100644 index 0000000000..f9544c2f8c --- /dev/null +++ b/dom/events/crashtests/104310-1.html @@ -0,0 +1,22 @@ +<HTML>
+
+<HEAD>
+</HEAD>
+
+<BODY onload=document.input.name.focus()>
+
+
+<form method="post" action="index.cfm" name="input">
+<CENTER><TABLE BORDER=0>
+<TD><INPUT TYPE="text" NAME="name" onClick="this.focus()" onFocus="this.select()" onSelect="this.select()"></TD>
+
+</TABLE></CENTER>
+<HR>
+
+</FORM>
+
+</BODY>
+
+</HTML>
+
+
diff --git a/dom/events/crashtests/1072137-1.html b/dom/events/crashtests/1072137-1.html new file mode 100644 index 0000000000..ae26188abf --- /dev/null +++ b/dom/events/crashtests/1072137-1.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html> +<script> + +function boom() +{ + var textareaRoot = document.createElement("textarea"); + document.removeChild(document.documentElement); + document.appendChild(textareaRoot); + var input = document.createElement("input"); + textareaRoot.appendChild(input); + input.select(); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/events/crashtests/1143972-1.html b/dom/events/crashtests/1143972-1.html new file mode 100644 index 0000000000..992bf94782 --- /dev/null +++ b/dom/events/crashtests/1143972-1.html @@ -0,0 +1,12 @@ +<!DOCTYPE HTML> +<script> +var x; +function doTest() { + f.contentDocument.body.onclick = function (event) { + x = event.offsetX; + } + f.contentDocument.body.dispatchEvent(f.contentWindow.ev); +} +</script> +<iframe id="f" style="display:none" onload="doTest()" + src="data:text/html,<script>var ev = new MouseEvent('click', {clientX:0, clientY:0})</script>"></iframe> diff --git a/dom/events/crashtests/116206-1.html b/dom/events/crashtests/116206-1.html new file mode 100644 index 0000000000..b04c150978 --- /dev/null +++ b/dom/events/crashtests/116206-1.html @@ -0,0 +1,23 @@ +<html> + <head> + <script language="JavaScript"> + function InitialFocus(){ + document.frmSelectUser.radResidence[0].focus(); + } + </script> + </head> + <body onfocus="InitialFocus();" > + <form name="frmSelectUser"> + <table> + <tbody> + <tr> + <td><input name="radResidence" type="radio" value="KOR"></td> + </tr> + <tr> + <td><input name="radResidence" type="radio" value="JPN"></td> + </tr> + </tbody> + </table> + </form> + </body> +</html> diff --git a/dom/events/crashtests/1190036-1.html b/dom/events/crashtests/1190036-1.html new file mode 100644 index 0000000000..00a6a25db6 --- /dev/null +++ b/dom/events/crashtests/1190036-1.html @@ -0,0 +1,15 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> + +function boom() { + var ev = new ClipboardEvent("p"); + ev.clipboardData.getFilesAndDirectories(); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/events/crashtests/135345-1.html b/dom/events/crashtests/135345-1.html new file mode 100644 index 0000000000..f9bfe0275a --- /dev/null +++ b/dom/events/crashtests/135345-1.html @@ -0,0 +1,14 @@ +<html> +<body> + <form name="frmlogin"> + <input type="text" name="username" + onfocus="frmlogin.username.select();" + onblur="frmlogin.password.focus();"> + <input type="password" name="password" + onfocus="frmlogin.password.select();"> + </form> + <script language="JavaScript"> + document.frmlogin.username.focus(); + </script> +</body> +</html> diff --git a/dom/events/crashtests/1397711.html b/dom/events/crashtests/1397711.html new file mode 100644 index 0000000000..fef4db2fb5 --- /dev/null +++ b/dom/events/crashtests/1397711.html @@ -0,0 +1,11 @@ +<!DOCTYPE html> +<script> + let code = "x".charCodeAt(0); + let e = new KeyboardEvent("keypress", { + keyCode: code, + charCode: code, + bubbles: true + }); + let utils = SpecialPowers.getDOMWindowUtils(window); + utils.dispatchDOMEventViaPresShellForTesting(document.documentElement, e); +</script> diff --git a/dom/events/crashtests/1856737.html b/dom/events/crashtests/1856737.html new file mode 100644 index 0000000000..76ef9f4765 --- /dev/null +++ b/dom/events/crashtests/1856737.html @@ -0,0 +1,19 @@ +<!DOCTYPE HTML> +<script> +let container = document.documentElement; +for(let i = 0; i < 256; i++) { + let div = document.createElement("div"); + container.appendChild(div); + container = div; +} + +let input = document.createElement("input"); +input.type = "radio"; +container.appendChild(input); + +let evt = new MouseEvent("click", { + bubbles: true, + cancelable: true, +}); +input.dispatchEvent(evt); +</script> diff --git a/dom/events/crashtests/457776-1.html b/dom/events/crashtests/457776-1.html new file mode 100644 index 0000000000..2c3910815d --- /dev/null +++ b/dom/events/crashtests/457776-1.html @@ -0,0 +1,9 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script> +new XMLHttpRequest().upload.onabort = function(){}; +</script> +</head> +<body> +</body> +</html> diff --git a/dom/events/crashtests/496308-1.html b/dom/events/crashtests/496308-1.html new file mode 100644 index 0000000000..29d9a646c6 --- /dev/null +++ b/dom/events/crashtests/496308-1.html @@ -0,0 +1,3 @@ +<script> + document.createEvent("popupblockedevents").requestingWindow; +</script> diff --git a/dom/events/crashtests/682637-1.html b/dom/events/crashtests/682637-1.html new file mode 100644 index 0000000000..6ae7336f25 --- /dev/null +++ b/dom/events/crashtests/682637-1.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html> + +<head> +<script> + +function boom() +{ + var frame = document.getElementById("f"); + var frameWin = frame.contentWindow; + frame.remove(); + frameWin.onmouseover = function(){}; +} + +</script> +</head> + +<body onload="boom();"> +<iframe id="f" src="data:text/html,1"></iframe> +</body> + +</html> diff --git a/dom/events/crashtests/938341.html b/dom/events/crashtests/938341.html new file mode 100644 index 0000000000..3190b4a6b5 --- /dev/null +++ b/dom/events/crashtests/938341.html @@ -0,0 +1,7 @@ +<html hidden> +<script> +function a(){document.getElementById('id1').click();} +window.onload = a; +</script> +<applet <ol onclick='' contenteditable='true' onended='' oncanplay=''> +<article id='id1'></article>
\ No newline at end of file diff --git a/dom/events/crashtests/crashtests.list b/dom/events/crashtests/crashtests.list new file mode 100644 index 0000000000..05ee336b11 --- /dev/null +++ b/dom/events/crashtests/crashtests.list @@ -0,0 +1,19 @@ +skip-if(ThreadSanitizer) load 104310-1.html +load 116206-1.html +load 135345-1.html +load 457776-1.html +load 496308-1.html +load 682637-1.html +load 938341.html +load 1033343.html +load 1035654-1.html +load 1035654-2.html +needs-focus load 1072137-1.html +load 1143972-1.html +load 1190036-1.html +load eventctor-nulldictionary.html +load eventctor-nullstorage.html +load recursive-DOMNodeInserted.html +load recursive-onload.html +load 1397711.html +load 1856737.html diff --git a/dom/events/crashtests/eventctor-nulldictionary.html b/dom/events/crashtests/eventctor-nulldictionary.html new file mode 100644 index 0000000000..f813994139 --- /dev/null +++ b/dom/events/crashtests/eventctor-nulldictionary.html @@ -0,0 +1,4 @@ +<!DOCTYPE html> +<script> +new MouseEvent("click", null); +</script> diff --git a/dom/events/crashtests/eventctor-nullstorage.html b/dom/events/crashtests/eventctor-nullstorage.html new file mode 100644 index 0000000000..beae2f3dfd --- /dev/null +++ b/dom/events/crashtests/eventctor-nullstorage.html @@ -0,0 +1,4 @@ +<!DOCTYPE html> +<script> +new StorageEvent("").storageArea; +</script> diff --git a/dom/events/crashtests/recursive-DOMNodeInserted.html b/dom/events/crashtests/recursive-DOMNodeInserted.html new file mode 100644 index 0000000000..c3e6f41d57 --- /dev/null +++ b/dom/events/crashtests/recursive-DOMNodeInserted.html @@ -0,0 +1,17 @@ +<HTML>
+<HEAD>
+<TITLE></TITLE>
+
+</HEAD>
+<BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#0000FF" VLINK="#800080" onload="test()">
+<INPUT id="txt1" type="text" value="">
+
+<SCRIPT>
+document.addEventListener("DOMNodeInserted",test,0);
+count = 0;
+function test(){
+ n = document.createTextNode("test");
+ document.body.appendChild(n);
+}
+</SCRIPT>
+</BODY>
diff --git a/dom/events/crashtests/recursive-onload.html b/dom/events/crashtests/recursive-onload.html new file mode 100644 index 0000000000..e8f15610b2 --- /dev/null +++ b/dom/events/crashtests/recursive-onload.html @@ -0,0 +1 @@ +<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML>
<head>
<title>Goodjet!</title>
<script language="JavaScript">
function onload()
{
// nothing here
}
</script>
</head>
<body onload ="onload();">
Body text
</body>
</html>
\ No newline at end of file |