diff options
Diffstat (limited to 'testing/web-platform/tests/mathml/crashtests')
92 files changed, 1798 insertions, 0 deletions
diff --git a/testing/web-platform/tests/mathml/crashtests/children-with-negative-block-sizes.html b/testing/web-platform/tests/mathml/crashtests/children-with-negative-block-sizes.html new file mode 100644 index 0000000000..c50f9be153 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/children-with-negative-block-sizes.html @@ -0,0 +1,142 @@ +<!DOCTYPE html> +<style> + /* These are children with negative block sizes. Absolute values are chosen + large enough compared to math layout constants. */ + span { display: inline-block; } + mspace, span { + margin-block-start: -10em; + margin-block-end: -10em; + } + /* Override display: none; from UA style sheet for the following children. */ + maction > :not(:first-child), + semantics > annotation, + semantics > annotation-xml { + display: math; + } +</style> +<math> + <mi><span></span></mi> + <mn><span></span></mn> + <mo><span></span></mo> + <ms><span></span></ms> + <mtext><span></span></mtext> +</math> +<math> + <semantics> + <mspace/> + <annotation><span></span></annotation> + <annotation-xml><span></span></annotation-xml> + </semantics> +</math> +<math> + <mtable> + <mtr> + <mtd><mspace/></mtd> + <mtd><mspace/></mtd> + <mtd><mspace/></mtd> + </mtr> + <mtr> + <mtd><mspace/></mtd> + <mtd><mspace/></mtd> + <mtd><mspace/></mtd> + </mtr> + </mtable> +</math> +<math> + <mspace/> + <mspace/> + <mspace/> + <mspace/> +</math> +<math> + <maction> + <mspace/> + <mspace/> + <mspace/> + <mspace/> + </maction> + <merror> + <mspace/> + <mspace/> + <mspace/> + <mspace/> + </merror> + <mpadded> + <mspace/> + <mspace/> + <mspace/> + <mspace/> + </mpadded> + <mphantom> + <mspace/> + <mspace/> + <mspace/> + <mspace/> + </mphantom> + <mstyle> + <mspace/> + <mspace/> + <mspace/> + <mspace/> + </mstyle> +</math> +<math> + <mfrac> + <mspace/> + <mspace/> + </mfrac> + <mfrac linethickness="0"> + <mspace/> + <mspace/> + </mfrac> +</math> +<math> + <msqrt> + <mspace/> + <mspace/> + <mspace/> + <mspace/> + </msqrt> + <mroot> + <mspace/> + <mspace/> + </mroot> +</math> +<math> + <msup> + <mspace/> + <mspace/> + </msup> + <msub> + <mspace/> + <mspace/> + </msub> + <msubsup> + <mspace/> + <mspace/> + <mspace/> + </msubsup> + <mmultiscripts> + <mspace/> + <mspace/> + <mspace/> + <mprescripts/> + <mspace/> + <mspace/> + </mmultiscripts> +</math> +<math> + <mover> + <mspace/> + <mspace/> + </mover> + <munder> + <mspace/> + <mspace/> + </munder> + <munderover> + <mspace/> + <mspace/> + <mspace/> + </munderover> +</math> diff --git a/testing/web-platform/tests/mathml/crashtests/children-with-negative-inline-sizes.html b/testing/web-platform/tests/mathml/crashtests/children-with-negative-inline-sizes.html new file mode 100644 index 0000000000..5c41fc8969 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/children-with-negative-inline-sizes.html @@ -0,0 +1,142 @@ +<!DOCTYPE html> +<style> + /* These are children with negative block sizes. Absolute values are chosen + large enough compared to math layout constants. */ + span { display: inline-block; } + mspace, span { + margin-inline-start: -10em; + margin-inline-end: -10em; + } + /* Override display: none; from UA style sheet for the following children. */ + maction > :not(:first-child), + semantics > annotation, + semantics > annotation-xml { + display: math; + } +</style> +<math> + <mi><span></span></mi> + <mn><span></span></mn> + <mo><span></span></mo> + <ms><span></span></ms> + <mtext><span></span></mtext> +</math> +<math> + <semantics> + <mspace/> + <annotation><span></span></annotation> + <annotation-xml><span></span></annotation-xml> + </semantics> +</math> +<math> + <mtable> + <mtr> + <mtd><mspace/></mtd> + <mtd><mspace/></mtd> + <mtd><mspace/></mtd> + </mtr> + <mtr> + <mtd><mspace/></mtd> + <mtd><mspace/></mtd> + <mtd><mspace/></mtd> + </mtr> + </mtable> +</math> +<math> + <mspace/> + <mspace/> + <mspace/> + <mspace/> +</math> +<math> + <maction> + <mspace/> + <mspace/> + <mspace/> + <mspace/> + </maction> + <merror> + <mspace/> + <mspace/> + <mspace/> + <mspace/> + </merror> + <mpadded> + <mspace/> + <mspace/> + <mspace/> + <mspace/> + </mpadded> + <mphantom> + <mspace/> + <mspace/> + <mspace/> + <mspace/> + </mphantom> + <mstyle> + <mspace/> + <mspace/> + <mspace/> + <mspace/> + </mstyle> +</math> +<math> + <mfrac> + <mspace/> + <mspace/> + </mfrac> + <mfrac linethickness="0"> + <mspace/> + <mspace/> + </mfrac> +</math> +<math> + <msqrt> + <mspace/> + <mspace/> + <mspace/> + <mspace/> + </msqrt> + <mroot> + <mspace/> + <mspace/> + </mroot> +</math> +<math> + <msup> + <mspace/> + <mspace/> + </msup> + <msub> + <mspace/> + <mspace/> + </msub> + <msubsup> + <mspace/> + <mspace/> + <mspace/> + </msubsup> + <mmultiscripts> + <mspace/> + <mspace/> + <mspace/> + <mprescripts/> + <mspace/> + <mspace/> + </mmultiscripts> +</math> +<math> + <mover> + <mspace/> + <mspace/> + </mover> + <munder> + <mspace/> + <mspace/> + </munder> + <munderover> + <mspace/> + <mspace/> + <mspace/> + </munderover> +</math> diff --git a/testing/web-platform/tests/mathml/crashtests/chrome-bug-1287843.html b/testing/web-platform/tests/mathml/crashtests/chrome-bug-1287843.html new file mode 100644 index 0000000000..6fc95fc12e --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/chrome-bug-1287843.html @@ -0,0 +1,12 @@ +<!DOCTYPE html> +<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org"> +<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1287843"> +<div style="columns:2;"> + <math> + <mtd> + <mtable> + <mtr></mtr> + </mtable> + </mtd> + </math> +</div> diff --git a/testing/web-platform/tests/mathml/crashtests/display-and-column-properties.html b/testing/web-platform/tests/mathml/crashtests/display-and-column-properties.html new file mode 100644 index 0000000000..c40a2a0549 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/display-and-column-properties.html @@ -0,0 +1,30 @@ +<!DOCTYPE html> +<html class="test-wait"> + <head> + <title>MathML elements with display and column properties</title> + <meta charset="utf-8"/> + <style> + math { + column-width: 100px; + } + </style> + </head> + <body> + <math></math> + <math style="display: list-item"></math> + <script> + window.addEventListener("load", function() { + // Force initial layout. + document.documentElement.getBoundingClientRect(); + + // Change display and reforce layout. + let maths = document.getElementsByTagName("math"); + maths[0].setAttribute("style", "display: list-item"); + maths[1].removeAttribute("style"); + document.documentElement.getBoundingClientRect(); + + document.documentElement.classList.remove("test-wait"); + }); + </script> + </body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/dynamic-height-within-table-cell.html b/testing/web-platform/tests/mathml/crashtests/dynamic-height-within-table-cell.html new file mode 100644 index 0000000000..cf42101bc8 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/dynamic-height-within-table-cell.html @@ -0,0 +1,33 @@ +<!DOCTYPE> +<html class="test-wait"> + <head> + <title>Dynamic height within table cell</title> + <meta charset="utf-8"/> + <link rel="author" title="FrΓ©dΓ©ric Wang" href="mailto:fwang@igalia.com"> + <link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1254572"> + <style> + #cell { + position: relative; + } + #elementToResize { + position: absolute; + height: 50px; + } + </style> + </head> + <body> + <math> + <mtd id="cell"> + <mrow id="elementToResize"></mrow> + </mtd> + </math> + <script> + window.addEventListener("load", () => { + window.requestAnimationFrame(() => { + elementToResize.style.height = "0px"; + document.documentElement.classList.remove('test-wait'); + }); + }); + </script> + </body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/first-letter-contributed-to-ancestor.html b/testing/web-platform/tests/mathml/crashtests/first-letter-contributed-to-ancestor.html new file mode 100644 index 0000000000..f50841d94a --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/first-letter-contributed-to-ancestor.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1495811"> +<style> + math { + display: inline-block; + } + math::first-letter { + background-color: blue; + } +</style> +<math> + <mo id="mo">%</mo> +</math> +<script> + mo.appendChild(document.createTextNode("A")); + document.body.innerText += ""; +</script> diff --git a/testing/web-platform/tests/mathml/crashtests/fixed-pos-children.html b/testing/web-platform/tests/mathml/crashtests/fixed-pos-children.html new file mode 100644 index 0000000000..773439d6f3 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/fixed-pos-children.html @@ -0,0 +1,25 @@ +<style> + * { + border-bottom: hsla(115.49088416259553deg 12% 15% / 18%) groove thin; + -webkit-text-stroke: InactiveCaptionText thin; + scale: -121 + } + + * * { + padding-inline: 69%; + } +</style> +<script> + document.addEventListener('DOMContentLoaded', () => { + const style = document.createElement('style') + document.head.appendChild(style) + style.sheet.insertRule('* {-webkit-mask-image:url(', 0) + }) +</script> +<math> + <mmultiscripts> + <mglyph> + <maligngroup style='position:fixed'></maligngroup> + </mglyph> + </mmultiscripts> +</math>
\ No newline at end of file diff --git a/testing/web-platform/tests/mathml/crashtests/math-depth-overflow.html b/testing/web-platform/tests/mathml/crashtests/math-depth-overflow.html new file mode 100644 index 0000000000..e096dbb558 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/math-depth-overflow.html @@ -0,0 +1,10 @@ +<script> +document.addEventListener('DOMContentLoaded', () => { + let a = document.createElementNS('http://www.w3.org/1998/Math/MathML', 'math') + a.setAttribute('scriptlevel', '127') + let b = document.createElementNS('http://www.w3.org/1998/Math/MathML', 'mstyle') + b.setAttribute('scriptlevel', '+2147483645') + a.appendChild(b) + document.documentElement.appendChild(a) +}) +</script> diff --git a/testing/web-platform/tests/mathml/crashtests/mathml-in-svg-001.html b/testing/web-platform/tests/mathml/crashtests/mathml-in-svg-001.html new file mode 100644 index 0000000000..94a905f3b0 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mathml-in-svg-001.html @@ -0,0 +1,3 @@ +<!DOCTYPE html> +<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1262555"> +<svg><foreignObject><math><mn>42</mn></math></foreignObject></svg> diff --git a/testing/web-platform/tests/mathml/crashtests/mmultiscripts-with-two-prescripts.html b/testing/web-platform/tests/mathml/crashtests/mmultiscripts-with-two-prescripts.html new file mode 100644 index 0000000000..54f9384606 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mmultiscripts-with-two-prescripts.html @@ -0,0 +1,8 @@ +<!DOCTYPE html> +<math> + <mmultiscripts> + <mrow></mrow> + <mprescripts></mprescripts> + <mprescripts></mprescripts> + </mmultiscripts> +</math> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1028521-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/1028521-1.xhtml new file mode 100644 index 0000000000..b8d0947741 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/1028521-1.xhtml @@ -0,0 +1,5 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<body> +<mstyle xmlns="http://www.w3.org/1998/Math/MathML"><li xmlns="http://www.w3.org/1999/xhtml" dir="rtl"></li></mstyle> +</body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1061027.html b/testing/web-platform/tests/mathml/crashtests/mozilla/1061027.html new file mode 100644 index 0000000000..3187f500a3 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/1061027.html @@ -0,0 +1,12 @@ +<style> +.c1 { transform-style: preserve-3d; display: table-row-group;</style><script> +var docElement = document.documentElement; +function init() { +test1 = document.createElementNS("http://www.w3.org/1999/xhtml", "defs"); +test1.setAttribute("class", "c1"); +docElement.appendChild(test1); +test2 = document.createElementNS("http://www.w3.org/1998/Math/MathML", "msub"); +test1.appendChild(test2); +} +document.addEventListener("DOMContentLoaded", init); +</script>
\ No newline at end of file diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1221888-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/1221888-1.html new file mode 100644 index 0000000000..741daa7503 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/1221888-1.html @@ -0,0 +1,15 @@ +<!DOCTYPE htm> +<html> +<head> +<meta charset="UTF-8"> +</head> +<body> + + <div> + <math> + <mspace height="50px" width="100px" style="outline-style: dotted;"></mspace> + </math> + </div> + +</body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1373767-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/1373767-1.html new file mode 100644 index 0000000000..a159cec7be --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/1373767-1.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<style> +math { + position: fixed; +} +div { + transform: translateZ(0px); +} +body { + display: -moz-box; +} +</style> +</head> +<body> +<div> +<math></math> +</div> +</body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1376158.html b/testing/web-platform/tests/mathml/crashtests/mozilla/1376158.html new file mode 100644 index 0000000000..42b6dd73c8 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/1376158.html @@ -0,0 +1,6 @@ +<math> +<munderover> +></ms> +<munder accentunder="true"> +<mo>)</mo> +<mscarry> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/151054-1.xml b/testing/web-platform/tests/mathml/crashtests/mozilla/151054-1.xml new file mode 100644 index 0000000000..f634d089f3 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/151054-1.xml @@ -0,0 +1,15 @@ +<?xml version="1.0"?> +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> + <meta http-equiv="Content-Type" content="text/html" /> + <title>Math with position: absolute</title> + <style> + math { position: absolute; } + </style> +</head> +<body> + <math xmlns="http://www.w3.org/1998/Math/MathML"> + <infinity/> + </math> +</body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1600635.html b/testing/web-platform/tests/mathml/crashtests/mozilla/1600635.html new file mode 100644 index 0000000000..d6ad315885 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/1600635.html @@ -0,0 +1,16 @@ +<style> + * { + overflow-inline: scroll; + } +</style> +<script> + window.addEventListener('load', () => { + const mbsubsup = document.createElementNS('http://www.w3.org/1998/Math/MathML', 'msubsup') + const m = document.createElementNS('http://www.w3.org/1998/Math/MathML', 'm') + const ms = document.createElementNS('http://www.w3.org/1998/Math/MathML', 'ms') + mbsubsup.appendChild(m) + ms.innerHTML = '<figure>' + mbsubsup.appendChild(ms) + document.documentElement.appendChild(mbsubsup) + }) +</script> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/289180-1.xml b/testing/web-platform/tests/mathml/crashtests/mozilla/289180-1.xml new file mode 100644 index 0000000000..8d1f2e843c --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/289180-1.xml @@ -0,0 +1,16 @@ + + + <math xmlns="http://www.w3.org/1998/Math/MathML" mode="inline"> + <mfrac> + <mi>x</mi> + <mi>y</mi> + </mfrac> + </math> + <math xmlns="http://www.w3.org/1998/Math/MathML" mode="display"> + <mfrac> + + <mi>x</mi> + <mi>y</mi> + </mfrac> + </math> + diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/307826-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/307826-1.xhtml new file mode 100644 index 0000000000..02d436e825 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/307826-1.xhtml @@ -0,0 +1,30 @@ +ο»Ώ<html xmlns="http://www.w3.org/1999/xhtml" class="test-wait"> + +<head> + +<title>Testcase for MathML crash</title> + +<script><![CDATA[ + +function boom() { + var div = document.getElementById("div"); + var mi = document.getElementById("mi"); + mi.appendChild(div); + mi.removeChild(div); + + document.documentElement.removeAttribute("class"); +} + +]]></script> + +</head> + + +<body onload="setTimeout(boom, 30);"> + +<div style="float: right;" id="div">Floated div</div> + +<math xmlns="http://www.w3.org/1998/Math/MathML" display="block"><mi id="mi">mi</mi></math> + +</body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/307839-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/307839-1.xhtml new file mode 100644 index 0000000000..a26e58ac07 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/307839-1.xhtml @@ -0,0 +1,15 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> + <head> + <title>Testcase</title> + </head> + <body onload="document.getElementById('B').appendChild(document.getElementById('A'));"> + <div style="position: relative;"> + <math xmlns="http://www.w3.org/1998/Math/MathML"> + <mover> + <mrow id="A"/> + <mn id="B"/> + </mover> + </math> + </div> + </body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/307839-2.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/307839-2.xhtml new file mode 100644 index 0000000000..05dc08a78f --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/307839-2.xhtml @@ -0,0 +1,24 @@ +<?xml version="1.0"?> +<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1 plus MathML 2.0//EN" "http://www.w3.org/TR/MathML2/dtd/xhtml-math11-f.dtd" [ + <!ENTITY mathml "http://www.w3.org/1998/Math/MathML"> +]> +<html xmlns="http://www.w3.org/1999/xhtml"> + +<head> +<title>Testcase bug - Evil mrow:hover testcase crashes Mozilla</title> +<style type="text/css"> +#h:hover{display:block;} +</style> +</head> +<body onload="document.getElementById('mrow').setAttribute('id', 'h');"> +<math mode="display" xmlns="http://www.w3.org/1998/Math/MathML"> +<mover> + <mrow id="mrow">hovering over this should not crash Mozilla</mrow> + <mover> + <mo>10</mo> + <mrow>times</mrow> + </mover> +</mover> +</math> +</body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/323733-1.xml b/testing/web-platform/tests/mathml/crashtests/mozilla/323733-1.xml new file mode 100644 index 0000000000..5551d8588c --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/323733-1.xml @@ -0,0 +1,7 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> + <div> + <math xmlns="http://www.w3.org/1998/Math/MathML" display="inline"> + <ms /> + </math> + </div> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/323737-1.xml b/testing/web-platform/tests/mathml/crashtests/mozilla/323737-1.xml new file mode 100644 index 0000000000..ad673f9460 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/323737-1.xml @@ -0,0 +1,9 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> + <div> + <math xmlns="http://www.w3.org/1998/Math/MathML" display="inline"> + <mtable> + <mroot /> + </mtable> + </math> + </div> +</html>
\ No newline at end of file diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/323738-1.xml b/testing/web-platform/tests/mathml/crashtests/mozilla/323738-1.xml new file mode 100644 index 0000000000..318aa93b4e --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/323738-1.xml @@ -0,0 +1,11 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> + <div> + <math xmlns="http://www.w3.org/1998/Math/MathML" display="inline"> + <msub> + <mo> + <factorial /> + </mo> + </msub> + </math> + </div> +</html>
\ No newline at end of file diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/323741-1.xml b/testing/web-platform/tests/mathml/crashtests/mozilla/323741-1.xml new file mode 100644 index 0000000000..8527c1a783 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/323741-1.xml @@ -0,0 +1,13 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> + <div> + <math xmlns="http://www.w3.org/1998/Math/MathML" display="inline"> + <notin> + <mspace> + <mfenced /> + </mspace> + + f + </notin> + </math> + </div> +</html>
\ No newline at end of file diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/323742-1.xml b/testing/web-platform/tests/mathml/crashtests/mozilla/323742-1.xml new file mode 100644 index 0000000000..2cd225990d --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/323742-1.xml @@ -0,0 +1,16 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> + <div> + <math xmlns="http://www.w3.org/1998/Math/MathML" display="inline"> + + <eulergamma> + <arcsech> + <mrow> + <mtable> + <maction/> + </mtable> + </mrow> + </arcsech> + </eulergamma> + </math> + </div> +</html>
\ No newline at end of file diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/336074-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/336074-1.xhtml new file mode 100644 index 0000000000..3d1f5b4223 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/336074-1.xhtml @@ -0,0 +1,25 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="test-wait"> + +<head> + +<script> +<![CDATA[ + +function init() +{ + var k = document.getElementById("k"); + k.remove(); + document.documentElement.removeAttribute("class"); +} + +]]> +</script> + +</head> + +<body onload="setTimeout(init, 30);"> + +<mo xmlns='http://www.w3.org/1998/Math/MathML'><mi id="k">z</mi></mo> + +</body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/347355-1-inner.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/347355-1-inner.xhtml new file mode 100644 index 0000000000..22689c3c12 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/347355-1-inner.xhtml @@ -0,0 +1,28 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script> + +function foo() +{ + var mrow = document.getElementById("mrow") + + mrow.parentNode.removeChild(mrow); +} + +</script> +</head> + +<body onload="setTimeout(foo, 100)"> + +<div> +<math xmlns="http://www.w3.org/1998/Math/MathML" display="block"> + <mrow id="mrow"> + <mtd><img xmlns="http://www.w3.org/1999/xhtml" src="347355-1.gif" /></mtd> + <mtable>
<mtr>
<mtd><mi>t</mi></mtd>
</mtr>
</mtable> + </mrow> +</math> +</div> + +</body> + +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/347355-1.gif b/testing/web-platform/tests/mathml/crashtests/mozilla/347355-1.gif Binary files differnew file mode 100644 index 0000000000..475ea8c164 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/347355-1.gif diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/347355-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/347355-1.html new file mode 100644 index 0000000000..0d61fb9d4a --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/347355-1.html @@ -0,0 +1,9 @@ +<html class="test-wait"> +<head> +<script> +setTimeout('document.documentElement.className = ""', 1000); +</script> +<body> +<iframe src="347355-1-inner.xhtml"></iframe> +</body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/347495-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/347495-1.xhtml new file mode 100644 index 0000000000..4a65b8f34d --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/347495-1.xhtml @@ -0,0 +1,10 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<body> + +<div><math xmlns="http://www.w3.org/1998/Math/MathML" display="block"> + <munderover>
<mo>∏</mo>
<mn>1</mn>
</munderover> +</math></div> + +</body> + +</html>
\ No newline at end of file diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/347507-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/347507-1.xhtml new file mode 100644 index 0000000000..274ae48ff2 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/347507-1.xhtml @@ -0,0 +1,29 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script> + +function foo() +{ + var div = document.getElementById("div"); + div.appendChild(div.firstChild); + + var td = document.getElementById("td"); + td.setAttribute('rowspan', -2); +} + +</script> + +</head> + +<body onload="foo()"> + + +<div id="div"><math xmlns="http://www.w3.org/1998/Math/MathML" display="block"> + + <mtable>
<mtr>
<mtd id="td"><mi>y</mi></mtd>
</mtr>
</mtable> + +</math></div> + +</body> + +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/348492-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/348492-1.xhtml new file mode 100644 index 0000000000..f59c9353a4 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/348492-1.xhtml @@ -0,0 +1,31 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="test-wait"> +<head> + +<script> +var MATHML_NS = "http://www.w3.org/1998/Math/MathML"; + +function foo() +{ + var mmultiscripts = document.createElementNS(MATHML_NS, 'mmultiscripts'); + var mtd = document.createElementNS(MATHML_NS, 'mtd'); + + + document.body.appendChild(mmultiscripts); + aC(mmultiscripts, mtd); + aC(mmultiscripts, document.createTextNode('foo')); + + document.documentElement.removeAttribute("class"); +} + +function aC(q1, q2) { q1.appendChild(q2); } + +</script> +</head> + +<body onload="setTimeout(foo, 30)"> + + + +</body> + +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/348709-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/348709-1.xhtml new file mode 100644 index 0000000000..907ede6abb --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/348709-1.xhtml @@ -0,0 +1,20 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> + +<script> +function foo() +{ + document.getElementById("mtr").appendChild(document.createTextNode("a")); +} +</script> +</head> + +<body onload="foo()"> + +<div><math xmlns="http://www.w3.org/1998/Math/MathML" display="block"> +<mrow>
<mfenced open="[" close="]">
<mtable>
<mtr id="mtr">
<mtd><mi>x</mi></mtd>
<mtd><mi>y</mi></mtd>
</mtr>
</mtable>
</mfenced>
</mrow> +</math></div> + +</body> + +</html>
\ No newline at end of file diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/348811-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/348811-1.xhtml new file mode 100644 index 0000000000..f6557e5a67 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/348811-1.xhtml @@ -0,0 +1,26 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script> +function foo() +{ + var newTable = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mtable") + + document.getElementById("mtr").appendChild(newTable); +} +</script> +</head> + +<body onload="foo()"> + + +<div> + <math xmlns="http://www.w3.org/1998/Math/MathML" display="block"> + <mtable>
<mtr id="mtr">
<mtd> + <mi>x</mi> + </mtd>
</mtr>
</mtable>
</math> +</div> + + +</body> + +</html>
\ No newline at end of file diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/348811-2.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/348811-2.xhtml new file mode 100644 index 0000000000..d6a741765a --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/348811-2.xhtml @@ -0,0 +1,31 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script> +function foo() +{ + var m = "http://www.w3.org/1998/Math/MathML"; + var newTable = document.createElementNS(m, "mtable") + document.getElementById("mtable").appendChild(newTable); +} +</script> +</head> + +<body onload="foo()"> + + +<div> + <math xmlns="http://www.w3.org/1998/Math/MathML" display="block"> + <mtable id="mtable"> + <mtr id="mtr"> + <mtd> + <mi>x</mi> + </mtd> + </mtr> + </mtable> + </math> +</div> + + +</body> + +</html>
\ No newline at end of file diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/353612-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/353612-1.xhtml new file mode 100644 index 0000000000..386e66f933 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/353612-1.xhtml @@ -0,0 +1,17 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script> +function foo() +{ + document.getElementById("ms").setAttribute("lquote", "'"); +} +</script> +</head> + +<body onload="foo()"> + +<mtr xmlns="http://www.w3.org/1998/Math/MathML" /> +<mstyle xmlns="http://www.w3.org/1998/Math/MathML" id="ms" /> +</body> + +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/355986-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/355986-1.xhtml new file mode 100644 index 0000000000..787e1f6772 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/355986-1.xhtml @@ -0,0 +1,34 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> + + +<head> +<style> + +body * { + display: table-footer-group; + overflow: hidden scroll; +} + +</style> +</head> + + + +<body onload="document.getElementById('eee').style.display = 'inline';"> + + + + +<div id="eee"> + <math xmlns="http://www.w3.org/1998/Math/MathML" display="block"> + <mtable> + <mtr> + <mtd><mi>x</mi></mtd> + </mtr> + </mtable> + </math> +</div> + + +</body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/364685-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/364685-1.xhtml new file mode 100644 index 0000000000..ab2b56a2f8 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/364685-1.xhtml @@ -0,0 +1,19 @@ +<html xmlns="http://www.w3.org/1999/xhtml" + xmlns:math="http://www.w3.org/1998/Math/MathML"> + +<body onload="boom();"> + +<script> +function boom() +{ + document.getElementById("merror").appendChild(document.getElementById("s")); +} +</script> + +<math:merror id="merror"></math:merror> + +<span id="s" /> + +</body> +</html> + diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/366012-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/366012-1.xhtml new file mode 100644 index 0000000000..55f29f3ac3 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/366012-1.xhtml @@ -0,0 +1,23 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="test-wait"> + +<head> +<script> + +function boom() +{ + var doom = document.getElementById("doom"); + doom.parentNode.removeChild(doom); + document.documentElement.removeAttribute("class"); +} + +</script> +</head> + +<body onload="setTimeout(boom, 30);"> + <div> + <p id="doom">This paragraph disappears.</p> + <math xmlns='http://www.w3.org/1998/Math/MathML' display='block'><msub><mi>y</mi><mn>0</mn><frameset xmlns="http://www.w3.org/1999/xhtml" /></msub></math> + </div> +</body> + +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/366564-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/366564-1.xhtml new file mode 100644 index 0000000000..8bb112a30d --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/366564-1.xhtml @@ -0,0 +1,44 @@ +<?xml version='1.0' encoding='utf-8'?> +<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1 plus MathML 2.0//EN" "http://www.w3.org/Math/DTD/mathml2/xhtml-math11-f.dtd" > +<html xmlns="http://www.w3.org/1999/xhtml" class="test-wait"> +<head> +<script> +function boom1() +{ + document.getElementById("mfenced3").appendChild(document.getElementById("div4")); + setTimeout(boom2, 30); +} + +function boom2() +{ + document.getElementById("sup1").appendChild(document.getElementById("mo2")); + document.documentElement.removeAttribute("class"); +} + +</script> +</head> + +<body onload="setTimeout(boom1, 30);"> + +<div><math xmlns="http://www.w3.org/1998/Math/MathML" display="block"> + <msup id="sup1"> + <mi>b</mi> + <mn>2</mn> + </msup> +</math></div> + +<div><math xmlns="http://www.w3.org/1998/Math/MathML" display="block"> + <mi>j</mi> + <mo id="mo2">=</mo> + <mfenced id="mfenced3" open="[" close="]"> + <mn>55</mn> + </mfenced> +</math></div> + +<div id="div4"><math xmlns="http://www.w3.org/1998/Math/MathML" display="block"> + <mo> ∫ </mo> +</math></div> + +</body> + +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/367107-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/367107-1.html new file mode 100644 index 0000000000..775ace87e0 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/367107-1.html @@ -0,0 +1,22 @@ +<html> +<head> +<script> + +function boom() +{ + var MATHML_NS = "http://www.w3.org/1998/Math/MathML"; + + var mtr = document.createElementNS(MATHML_NS, 'mtr'); + var mtable = document.createElementNS(MATHML_NS, 'mtable'); + + document.body.appendChild(mtr); + mtr.appendChild(mtable); +} + +</script> +</head> + +<body onload="boom()"> + +</body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/368430-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/368430-1.xhtml new file mode 100644 index 0000000000..79e10c46ac --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/368430-1.xhtml @@ -0,0 +1,5 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<body> +<maction xmlns="http://www.w3.org/1998/Math/MathML">Foo Bar</maction> +</body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/370791-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/370791-1.xhtml new file mode 100644 index 0000000000..d72eb5f709 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/370791-1.xhtml @@ -0,0 +1,33 @@ +<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML" class="test-wait"> +<head> +<script> + +function boom() +{ + var mi = document.getElementById("mi"); + var textA = mi.firstChild; + var textB = document.createTextNode("b"); + var textSpace = document.createTextNode(" "); + + var floater = document.getElementById("floater"); + + mi.appendChild(textB); + mi.appendChild(textSpace); + mi.removeChild(textA); + mi.removeChild(textSpace); + + floater.parentNode.removeChild(floater); + + document.documentElement.removeAttribute("class"); +} + +</script> +</head> + +<body onload="setTimeout(boom, 30);"> + +<math:mi id="mi">a<p><span style="float: right;" id="floater" /></p></math:mi> + +</body> + +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/370862-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/370862-1.xhtml new file mode 100644 index 0000000000..fa2f1a4d67 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/370862-1.xhtml @@ -0,0 +1,27 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="test-wait"> + +<head> +<script> +function boom() +{ + var math = document.getElementById("math"); + var div = document.getElementById("div") + + math.setAttribute("color", "g"); + document.body.appendChild(div); + + document.documentElement.removeAttribute("class"); +} +</script> +</head> + +<body onload="setTimeout(boom, 30);"> + +<div id="div"> + +<mo xmlns='http://www.w3.org/1998/Math/MathML'>+<math id="math"><mn>1</mn></math></mo> + +</div> + +</body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/372483-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/372483-1.xhtml new file mode 100644 index 0000000000..41edd7d9b7 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/372483-1.xhtml @@ -0,0 +1,7 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<body> + +<div><munder xmlns="http://www.w3.org/1998/Math/MathML"/></div> + +</body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/373472-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/373472-1.xhtml new file mode 100644 index 0000000000..6c6a304a73 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/373472-1.xhtml @@ -0,0 +1,20 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script> +function boom() +{ + document.getElementById("mo").appendChild(document.getElementById("mo2")); + document.body.offsetWidth; + document.getElementById("span").appendChild(document.createTextNode("baz")); +} +</script> +</head> + +<body onload="boom();"> + +<p>Foo <math xmlns="http://www.w3.org/1998/Math/MathML"><mo id="mo2">-</mo></math></p> + +<p><math xmlns="http://www.w3.org/1998/Math/MathML"><msub id="msub"><mo id="mo">+</mo></msub></math> <span id="span">bar</span></p> + +</body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/373472-2.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/373472-2.xhtml new file mode 100644 index 0000000000..1c7e1c7ade --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/373472-2.xhtml @@ -0,0 +1,9 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +</head> +<body> + +<p><math xmlns="http://www.w3.org/1998/Math/MathML"><mroot><mo>k</mo></mroot></math></p> + +</body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/373533-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/373533-1.xhtml new file mode 100644 index 0000000000..247a5cb39a --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/373533-1.xhtml @@ -0,0 +1,32 @@ +<html xmlns="http://www.w3.org/1999/xhtml" + xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" + xmlns:math="http://www.w3.org/1998/Math/MathML"> +<head></head> +<body> + +<xul:box collapsed="true"><math:mrow><div id="div"> +<p id="para">Foo bar</p> +</div></math:mrow></xul:box> + +<script type="application/javascript"> +document.body.offsetWidth; + +try +{ + var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"; + + var para = document.getElementById("para"); + var div = document.getElementById("div"); + var hbox = document.createElementNS(XUL_NS, 'hbox'); + + div.appendChild(hbox); + div.removeChild(para); +} +catch (e) +{ + document.body.appendChild(document.createTextNode(e)); +} +</script> + +</body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/373533-2.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/373533-2.xhtml new file mode 100644 index 0000000000..16929262a2 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/373533-2.xhtml @@ -0,0 +1,31 @@ +<html xmlns="http://www.w3.org/1999/xhtml" + xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" + xmlns:math="http://www.w3.org/1998/Math/MathML"><head> +</head> +<body><xul:box collapsed="true"><math:mrow><div id="div"> +<p id="para">Foo bar</p> + +</div></math:mrow></xul:box> + +<script type="application/javascript"> +try +{ + document.body.offsetWidth; + + var para = document.getElementById("para"); + var div = document.getElementById("div"); + var hbox = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", + 'hbox'); + + div.appendChild(hbox); + + document.body.offsetWidth; + + div.appendChild(para); +} +catch (e) +{ + document.body.appendChild(document.createTextNode(e)); +} +</script> +</body></html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/373533-3.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/373533-3.xhtml new file mode 100644 index 0000000000..18c104096a --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/373533-3.xhtml @@ -0,0 +1,31 @@ +<html xmlns="http://www.w3.org/1999/xhtml" + xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" + xmlns:math="http://www.w3.org/1998/Math/MathML"> +<head> +</head><body><xul:box collapsed="true"><math:mrow><div id="div"> +<p id="para">Foo bar</p> + +</div></math:mrow></xul:box> + +<script type="application/javascript"> +try +{ + document.body.offsetWidth; + + var para = document.getElementById("para"); + var div = document.getElementById("div"); + var hbox = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", + 'hbox'); + + div.appendChild(hbox); + + document.body.offsetWidth; + + div.removeChild(para); +} +catch (e) +{ + document.body.appendChild(document.createTextNode(e)); +} +</script> +</body></html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/375562-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/375562-1.xhtml new file mode 100644 index 0000000000..7b00d1f91a --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/375562-1.xhtml @@ -0,0 +1,38 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="test-wait"> +<head> +<script> + +var HTML_NS = "http://www.w3.org/1999/xhtml"; + +function boom() +{ + var a = document.getElementById("a"); + var plus = document.getElementById("plus"); + var frameset = document.createElementNS(HTML_NS, "frameset"); + + document.body.style.width = "300px"; + + a.parentNode.removeChild(a); + + plus.appendChild(frameset); + + document.documentElement.removeAttribute("class"); +} + +</script> +</head> + +<body onload="setTimeout(boom, 30);"> + +<div><math xmlns="http://www.w3.org/1998/Math/MathML" display="block"> + <msup> + <mi id="a">a</mi> + <mo id="plus">+</mo> + <mi>b</mi> + <mi>c</mi> + </msup> +</math></div> + +</body> + +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/377824-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/377824-1.xhtml new file mode 100644 index 0000000000..ddbe7da664 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/377824-1.xhtml @@ -0,0 +1,5 @@ +<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML"> +<body> +<math:mtable /> +</body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/379418-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/379418-1.xhtml new file mode 100644 index 0000000000..dc6e9e5711 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/379418-1.xhtml @@ -0,0 +1,7 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<body> +<math xmlns="http://www.w3.org/1998/Math/MathML" display="block"> +ΧΆ</math> +</body> +</html> + diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/385226-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/385226-1.xhtml new file mode 100644 index 0000000000..b1d261eb38 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/385226-1.xhtml @@ -0,0 +1,29 @@ +<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml"> + +<head> +<style> +[class="capleft"] { caption-side: left; } +[class="collapse"] { visibility: collapse; } +</style> +</head> + +<body> + +<div> + <math xmlns="http://www.w3.org/1998/Math/MathML" display="block" class="collapse"> + <mtable> + <mtr> + <mtd><mi>x</mi></mtd> + <mtd><mi>y</mi></mtd> + </mtr> + <html:caption class="capleft"> + <mtd><mi>z</mi></mtd> + <mtd><mi>w</mi></mtd> + </html:caption> + </mtable> + </math> +</div> + +</body> + +</html>
\ No newline at end of file diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/393760-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/393760-1.xhtml new file mode 100644 index 0000000000..cb5c2d7a12 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/393760-1.xhtml @@ -0,0 +1,16 @@ +<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML"> +<head> +<script> +function boom() +{ + document.getElementById("mfenced").setAttribute("mathbackground", "yellow"); +} +</script> +</head> + +<body onload="boom();"> + +<math:mfenced id="mfenced" /> + +</body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/397518-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/397518-1.xhtml new file mode 100644 index 0000000000..bc460ead11 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/397518-1.xhtml @@ -0,0 +1,15 @@ +<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML"> +<head> +<script> +function boom() +{ + var span = document.getElementById("s"); + var newSpan = document.createElementNS("http://www.w3.org/1999/xhtml", "span"); + span.appendChild(newSpan); +} +</script> +</head> +<body onload="boom();"> +<math:math><span id="s"><div/></span></math:math> +</body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/398038-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/398038-1.html new file mode 100644 index 0000000000..b383141c45 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/398038-1.html @@ -0,0 +1,8 @@ +<html> +<head><title>Crashtest for bug 398038</title></head> +<body> + <math><mpadded height="20 10"/></math> + <math><mpadded height="10 0000000000em"/></math> + <math><mpadded height="10 1.2em"/></math> +</body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/400475-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/400475-1.xhtml new file mode 100644 index 0000000000..13ff2fcb63 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/400475-1.xhtml @@ -0,0 +1,16 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script> +function foo() +{ + document.getElementById("ms").setAttribute("foo", "x"); +} +</script> +</head> + +<body onload="foo()"> + +<mstyle xmlns="http://www.w3.org/1998/Math/MathML" id="ms" /> +</body> + +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/402400-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/402400-1.xhtml new file mode 100644 index 0000000000..5212d67f16 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/402400-1.xhtml @@ -0,0 +1,41 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script type="text/javascript"> + +function boom() +{ + var textB = document.createTextNode("b"); + var textC = document.createTextNode("c"); + var textN = document.createTextNode("n"); + var textP = document.createTextNode("p"); + + var blv = document.createElementNS("http://www.w3.org/1999/xhtml", "div"); + var odj = document.createElementNS("http://www.w3.org/1999/xhtml", "div"); + var tr = document.createElementNS("http://www.w3.org/1999/xhtml", "tr"); + var td = document.createElementNS("http://www.w3.org/1999/xhtml", "td"); + var mathMO = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mo"); + + td.appendChild(textB); + document.body.appendChild(blv); + blv.appendChild(tr); + blv.appendChild(mathMO); + mathMO.appendChild(textP); + odj.appendChild(td); + odj.appendChild(textN); + + blv.removeChild(tr); + mathMO.appendChild(odj); + td.removeChild(textB); + blv.appendChild(textC); + document.body.appendChild(odj); + odj.insertBefore(mathMO, textN); + document.body.appendChild(mathMO); + mathMO.appendChild(odj); +} + +</script> +</head> + +<body onload="boom();"></body> + +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/403156-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/403156-1.xhtml new file mode 100644 index 0000000000..b49bff7d04 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/403156-1.xhtml @@ -0,0 +1,12 @@ +<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML"> + +<head> +<style> +maction { height: 12em; } +</style> +</head> + +<body> +<m:maction>䦚<span>c<div>t䦚</div></span>䦚x䦚䦚2</m:maction> +</body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/404485-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/404485-1.xhtml new file mode 100644 index 0000000000..fea18cbd59 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/404485-1.xhtml @@ -0,0 +1,9 @@ +<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML"> + +<body onload="document.getElementById('s').firstChild.splitText(1);"> + +<math:msqrt><span xmlns="http://www.w3.org/1999/xhtml" id="s">x <math:mo/></span></math:msqrt> + +</body> + +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/405187-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/405187-1.xhtml new file mode 100644 index 0000000000..537512e629 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/405187-1.xhtml @@ -0,0 +1,10 @@ +<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML"> +<head> +<style id="s"> +[class="fx"] { position: fixed; } +</style> +</head> +<body onload="document.getElementById('s').textContent = '* { color: magenta; }'"> +<m:mrow><m:mrow class="fx" /><span class="fx" /></m:mrow> +</body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/405271-1.xml b/testing/web-platform/tests/mathml/crashtests/mozilla/405271-1.xml new file mode 100644 index 0000000000..c94525c638 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/405271-1.xml @@ -0,0 +1,36 @@ +<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML"> +<head> + +<style type="text/css"> +#q { width: 16px; height: 16px; } +#a, #b { counter-increment: chicken; } +</style> + +<style id="s" type="text/css"> +#a { content: 'x'; } +</style> + +<script type="text/javascript"> + +function boom() +{ + remove(document.getElementById("s")); + remove(document.getElementById("b")); +} + +function remove(n) +{ + n.parentNode.removeChild(n); +} + +</script> + +</head> + +<body onload="boom();"> + +<m:mrow id="a"/><m:mo id="q"><m:malignmark><m:msubsup/><m:munderover/><m:munder id="b"/></m:malignmark></m:mo> + +</body> + +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/412237-1.xml b/testing/web-platform/tests/mathml/crashtests/mozilla/412237-1.xml new file mode 100644 index 0000000000..2e8f13b73e --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/412237-1.xml @@ -0,0 +1,11 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +</head> +<body> + +<math xmlns="http://www.w3.org/1998/Math/MathML"> + <ms fontsize="-2%"><mfrac><mi>x</mi><mi>y</mi></mfrac></ms> +</math> + +</body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/413063-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/413063-1.xhtml new file mode 100644 index 0000000000..b595acd1ce --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/413063-1.xhtml @@ -0,0 +1,21 @@ +<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML"> +<head> +<script type="text/javascript"> + +function boom() +{ + var mtd = document.getElementById("mtd"); + var ns = document.createElementNS("http://www.w3.org/1999/xhtml", "span"); + var nt = document.createTextNode("foo"); + ns.appendChild(nt); + mtd.appendChild(ns); + mtd.setAttribute("rowspan", "0"); +} + + +</script> +</head> + +<body onload="boom();"><m:mtd id="mtd" style="display: table-footer-group"><m:mi /></m:mtd></body> + +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/416907-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/416907-1.xhtml new file mode 100644 index 0000000000..94a9abde21 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/416907-1.xhtml @@ -0,0 +1,5 @@ +<html xmlns="http://www.w3.org/1999/xhtml" xmlns:mathml="http://www.w3.org/1998/Math/MathML"> +<mathml:mroot> +<frameset/> +</mathml:mroot> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/420420-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/420420-1.xhtml new file mode 100644 index 0000000000..db17b277a7 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/420420-1.xhtml @@ -0,0 +1,7 @@ +<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1 plus MathML 2.0//EN" "http://www.w3.org/Math/DTD/mathml2/xhtml-math11-f.dtd"> + +<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML"> +<body> +<m:math><span><m:mfenced><m:mo>⁡</m:mo></m:mfenced></span></m:math> +</body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/431072-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/431072-1.xhtml new file mode 100644 index 0000000000..f25ce28f14 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/431072-1.xhtml @@ -0,0 +1,25 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> + +<script type="text/javascript"> + +function boom() +{ + document.getElementById("math").setAttribute("class", "li"); + document.documentElement.offsetHeight; + document.documentElement.appendChild(document.createTextNode("\n")); +} + +</script> + +<style type="text/css"> + +[class="li"] { display: list-item; } + +</style> + +</head> + +<body onload="boom();"><math xmlns="http://www.w3.org/1998/Math/MathML" id="math"/></body> + +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/443089-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/443089-1.xhtml new file mode 100644 index 0000000000..2630cea131 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/443089-1.xhtml @@ -0,0 +1,7 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +</head> +<body> +<mtd xmlns="http://www.w3.org/1998/Math/MathML" id="mtd" rowspan="1073741825"/> +</body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/462929-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/462929-1.html new file mode 100644 index 0000000000..386d8e138f --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/462929-1.html @@ -0,0 +1,12 @@ +<!DOCTYPE html> +<html> +<head> +<script type="text/javascript"> + +var a = document.createElementNS("http://www.w3.org/2000/svg", "foo"); +var b = document.createElementNS("http://www.w3.org/1998/Math/MathML", "math"); + +</script> +</head> +<body></body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/463763-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/463763-1.xhtml new file mode 100644 index 0000000000..61df8ff0c3 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/463763-1.xhtml @@ -0,0 +1,10 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<body> +<math xmlns="http://www.w3.org/1998/Math/MathML" + xmlns:h="http://www.w3.org/1999/xhtml"> +<msup style="display:block"><mo><h:frameset/></mo></msup> +<msub style="display:block"><mo><h:frameset/></mo></msub> +<msubsup style="display:block"><mo><h:frameset/></mo></msubsup> +</math> +</body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/463763-2.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/463763-2.xhtml new file mode 100644 index 0000000000..8d41abade0 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/463763-2.xhtml @@ -0,0 +1,12 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<body> +<math xmlns="http://www.w3.org/1998/Math/MathML" + xmlns:h="http://www.w3.org/1999/xhtml"> +<mstyle displaystyle="false"> +<munder style="display:block"><mo movablelimits="true"><h:frameset/></mo></munder> +<mover style="display:block"><mo movablelimits="true"><h:frameset/></mo></mover> +<munderover style="display:block"><mo movablelimits="true"><h:frameset/></mo></munderover> +</mstyle> +</math> +</body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/476547-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/476547-1.xhtml new file mode 100644 index 0000000000..0cece35eaa --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/476547-1.xhtml @@ -0,0 +1,5 @@ +<html xmlns="http://www.w3.org/1999/xhtml" style="quotes: '<1>' '';"> +<body onload="document.getElementById('ms').setAttribute('lquote', '');" style="direction: rtl;"> +<span><ms id="ms" xmlns="http://www.w3.org/1998/Math/MathML"><mstyle/></ms></span> +</body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/541620-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/541620-1.xhtml new file mode 100644 index 0000000000..ccef762e48 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/541620-1.xhtml @@ -0,0 +1,6 @@ +<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML"> +<body> +<m:ms><m:mfenced/></m:ms> +</body> +</html> + diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/557474-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/557474-1.html new file mode 100644 index 0000000000..1bf8d534ca --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/557474-1.html @@ -0,0 +1,11 @@ +<!DOCTYPE html> +<html> + <head> + <title>Test mpadded</title> + </head> + <body> + <math> + <mpadded width="-100px" height="-100px" depth="-100px"></mpadded> + </math> + </body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/654928-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/654928-1.html new file mode 100644 index 0000000000..da52f34b45 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/654928-1.html @@ -0,0 +1,3 @@ +<html> + <math><maction selection="2">A<mo>B</mo></maction></math> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/655451-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/655451-1.xhtml new file mode 100644 index 0000000000..0d5fb687b7 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/655451-1.xhtml @@ -0,0 +1,15 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script> + +function boom() +{ + document.documentElement.style.fontStyle = "oblique"; + var c = document.getElementById("c"); + c.parentNode.removeChild(c); +} + +</script> +</head> +<body onload="boom();"><math xmlns="http://www.w3.org/1998/Math/MathML"><frameset xmlns="http://www.w3.org/1999/xhtml"></frameset><msubsup id="c"/><mo><frameset xmlns="http://www.w3.org/1999/xhtml"></frameset></mo></math>x</body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/713606-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/713606-1.html new file mode 100644 index 0000000000..a0d4939a83 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/713606-1.html @@ -0,0 +1,24 @@ +<!DOCTYPE html> +<html> + <head> + <title>Crashtest bug 713606</title> + </head> + <body onload="document.querySelector('mstyle').setAttribute('scriptminsize', '0%');"> + <math> + <msubsup> + <mtext>X</mtext> + <mtable displaystyle="true"></mstyle> + </mtext>Y</mtext> + </msubsup> + </math> + <math> + <msubsup> + <mtext>X</mtext> + <mstyle displaystyle="true"></mstyle> + </mtext>Y</mtext> + </msubsup> + </math> + <math><mfrac><mstyle displaystyle="true"></mstyle></mfrac></math> + </body> +</html> + diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/716349-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/716349-1.html new file mode 100644 index 0000000000..9b5895ad64 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/716349-1.html @@ -0,0 +1,13 @@ +<!DOCTYPE html> +<html> + <head> + <title>Crashtest bug 716349</title> + </head> + <body> + <math> + <mspace width="-10px"/> + <mspace height="-10px"/> + </math> + </body> +</html> + diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/767251.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/767251.xhtml new file mode 100644 index 0000000000..aa3632a6ba --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/767251.xhtml @@ -0,0 +1 @@ +<html xmlns="http://www.w3.org/1999/xhtml" dir="rtl"><tr><span><math xmlns="http://www.w3.org/1998/Math/MathML"/><tr>n</tr></span></tr></html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/770710-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/770710-1.html new file mode 100644 index 0000000000..2171966769 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/770710-1.html @@ -0,0 +1,25 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var mo = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mo"); + var text = document.createTextNode(" "); + mo.appendChild(text); + document.body.appendChild(mo); + + window.getSelection().removeAllRanges(); + var r = document.createRange(); + r.setStart(mo.firstChild, 0); + r.setEnd(mo.firstChild, 1); + window.getSelection().addRange(r); + + window.getSelection().toString(); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/848725-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/848725-1.html new file mode 100644 index 0000000000..7ce9c434cc --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/848725-1.html @@ -0,0 +1,17 @@ +<!doctype html> +<html> + <head> + <title>Bug 848725</title> + <meta charset="utf-8"/> + </head> + <body> + <div> + <math> + <mover> + <mo>↠</mo> + <mspace width="500px"></mspace> + </mover> + </math> + </div> + </body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/848725-2.html b/testing/web-platform/tests/mathml/crashtests/mozilla/848725-2.html new file mode 100644 index 0000000000..b6362f9bf2 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/848725-2.html @@ -0,0 +1,17 @@ +<!doctype html> +<html> + <head> + <title>Bug 848725</title> + <meta charset="utf-8"/> + </head> + <body> + <div> + <math> + <mover> + <mo>↡</mo> + <mspace height="500px"></mspace> + </mover> + </math> + </div> + </body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/947557-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/947557-1.html new file mode 100644 index 0000000000..3ddfb7b984 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/947557-1.html @@ -0,0 +1,21 @@ +<!doctype html> +<body> + <math> + <mmultiscripts> + <mo>A</mo> + <mprescripts/> + <mmultiscripts> + <mo>A</mo> + <mprescripts/> + <mo>A</mo> + <mo>A</mo> + </mmultiscripts> + <mmultiscripts> + <mo>A</mo> + <mprescripts/> + <mo>A</mo> + <mo>A</mo> + </mmultiscripts> + </mmultiscripts> + </math> +</body> diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/973322-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/973322-1.xhtml new file mode 100644 index 0000000000..dfac127fb4 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mozilla/973322-1.xhtml @@ -0,0 +1,8 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> + <body onload="document.getElementById('f').setAttribute('class', 'e');"> + <math xmlns="http://www.w3.org/1998/Math/MathML"> + <mfenced id="f"/> + </math> + <p style="overflow: scroll; position: sticky;"></p> + </body> +</html> diff --git a/testing/web-platform/tests/mathml/crashtests/mspace-mpadded-negative-dimensions.html b/testing/web-platform/tests/mathml/crashtests/mspace-mpadded-negative-dimensions.html new file mode 100644 index 0000000000..97ae5b89b8 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mspace-mpadded-negative-dimensions.html @@ -0,0 +1,13 @@ +<!DOCTYPE html> +<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1421195"> +<math><mspace width="-1px"/></math> +<math><mspace height="-1px"/></math> +<math><mspace depth="-1px"/></math> +<math><mspace height="-2px" depth="1px"/></math> +<math><mspace height="1px" depth="-2px"/></math> +<math><mpadded width="-1px"/></math> +<math><mpadded height="-1px"/></math> +<math><mpadded depth="-1px"/></math> +<math><mpadded height="-2px" depth="1px"></mpadded></math> +<math><mpadded height="1px" depth="-2px"></mpadded></math> +<math><mpadded lspace="-1px"/></math> diff --git a/testing/web-platform/tests/mathml/crashtests/mtd-as-multicol.html b/testing/web-platform/tests/mathml/crashtests/mtd-as-multicol.html new file mode 100644 index 0000000000..f00fa48815 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/mtd-as-multicol.html @@ -0,0 +1,9 @@ +<!DOCTYPE html> +<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org"> +<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1354561"> +<div id="container"></div> +<script> + mtd = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mtd"); + mtd.style.columns = "2"; + container.appendChild(mtd); +</script> diff --git a/testing/web-platform/tests/mathml/crashtests/multicol-inside-ms.html b/testing/web-platform/tests/mathml/crashtests/multicol-inside-ms.html new file mode 100644 index 0000000000..b7d481e1fb --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/multicol-inside-ms.html @@ -0,0 +1,4 @@ +<!DOCTYPE html> +<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org"> +<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1178979"> +<math><ms><span><span style="columns:3;"> diff --git a/testing/web-platform/tests/mathml/crashtests/multicol-on-token-elements.html b/testing/web-platform/tests/mathml/crashtests/multicol-on-token-elements.html new file mode 100644 index 0000000000..9fc00eb691 --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/multicol-on-token-elements.html @@ -0,0 +1,11 @@ +<!DOCTYPE html> +<math><mi style="column-count: 10">mi</mi></math> +<math><mi style="column-width: 10px">mi</mi></math> +<math><mn style="column-count: 10">mn</mn></math> +<math><mn style="column-width: 10px">mn</mn></math> +<math><mo style="column-count: 10">mo</mo></math> +<math><mo style="column-width: 10px">mo</mo></math> +<math><ms style="column-count: 10">ms</ms></math> +<math><ms style="column-width: 10px">ms</ms></math> +<math><mtext style="column-count: 10">mtext</mtext></math> +<math><mtext style="column-width: 10px">mtext</mtext></math> diff --git a/testing/web-platform/tests/mathml/crashtests/operator-and-first-letter.html b/testing/web-platform/tests/mathml/crashtests/operator-and-first-letter.html new file mode 100644 index 0000000000..a4d56de72f --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/operator-and-first-letter.html @@ -0,0 +1,9 @@ +<!DOCTYPE html> +<style> + p::first-letter { --panel-arrowcontent-color:-moz-FieldText; } +</style> +<p> + <math display="block"> + <mo>∫</mo> + </math> +</p> diff --git a/testing/web-platform/tests/mathml/crashtests/scrollbar-caching-assert.html b/testing/web-platform/tests/mathml/crashtests/scrollbar-caching-assert.html new file mode 100644 index 0000000000..3f972ef70d --- /dev/null +++ b/testing/web-platform/tests/mathml/crashtests/scrollbar-caching-assert.html @@ -0,0 +1,17 @@ +<!doctype html> +<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1663740"> +<style> +@namespace url(http://www.w3.org/1998/Math/MathML); +* { + all: inherit; + overflow-inline: hidden; +} +</style> +<script> +window.addEventListener('load', () => { + var x = document.getElementById('a') + x.setAttribute('mathvariant', 'double-struck') + x.innerHTML = '<select></select>' +}) +</script> +<math id='a'> |
