From 26a029d407be480d791972afb5975cf62c9360a6 Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@progress-linux.org>
Date: Fri, 19 Apr 2024 02:47:55 +0200
Subject: Adding upstream version 124.0.1.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
---
 dom/xslt/crashtests/1089049.html       |  3 +++
 dom/xslt/crashtests/111994.xml         |  5 ++++
 dom/xslt/crashtests/111994.xsl         | 13 +++++++++
 dom/xslt/crashtests/1205163.xml        |  6 +++++
 dom/xslt/crashtests/1205163.xsl        | 11 ++++++++
 dom/xslt/crashtests/1243337.xml        |  3 +++
 dom/xslt/crashtests/1243337.xsl        |  6 +++++
 dom/xslt/crashtests/1330492.html       | 23 ++++++++++++++++
 dom/xslt/crashtests/1336828.html       | 22 +++++++++++++++
 dom/xslt/crashtests/1336830.html       | 27 +++++++++++++++++++
 dom/xslt/crashtests/1336832.html       | 28 +++++++++++++++++++
 dom/xslt/crashtests/1338277.html       | 21 +++++++++++++++
 dom/xslt/crashtests/1361892.html       | 23 ++++++++++++++++
 dom/xslt/crashtests/1430818.sjs        | 49 ++++++++++++++++++++++++++++++++++
 dom/xslt/crashtests/1430818.xml        |  4 +++
 dom/xslt/crashtests/1527277.html       | 14 ++++++++++
 dom/xslt/crashtests/1589930.xml        | 10 +++++++
 dom/xslt/crashtests/182460-select.xml  |  3 +++
 dom/xslt/crashtests/182460-selects.xsl |  5 ++++
 dom/xslt/crashtests/182460-table.xhtml |  9 +++++++
 dom/xslt/crashtests/226425.xml         |  4 +++
 dom/xslt/crashtests/226425.xsl         | 10 +++++++
 dom/xslt/crashtests/406106-1.html      | 18 +++++++++++++
 dom/xslt/crashtests/483444.xml         | 19 +++++++++++++
 dom/xslt/crashtests/485217.xml         |  8 ++++++
 dom/xslt/crashtests/485217.xsl         | 18 +++++++++++++
 dom/xslt/crashtests/485286.xml         | 12 +++++++++
 dom/xslt/crashtests/527558_1.xml       | 17 ++++++++++++
 dom/xslt/crashtests/528300.xml         | 22 +++++++++++++++
 dom/xslt/crashtests/528488.xml         | 19 +++++++++++++
 dom/xslt/crashtests/528963.xml         | 22 +++++++++++++++
 dom/xslt/crashtests/545927.html        | 28 +++++++++++++++++++
 dom/xslt/crashtests/601543.html        |  4 +++
 dom/xslt/crashtests/602115.html        | 22 +++++++++++++++
 dom/xslt/crashtests/603844.html        | 32 ++++++++++++++++++++++
 dom/xslt/crashtests/667315.xml         | 11 ++++++++
 dom/xslt/crashtests/91332.xml          | 10 +++++++
 dom/xslt/crashtests/91332.xsl          | 21 +++++++++++++++
 dom/xslt/crashtests/949990.html        | 15 +++++++++++
 dom/xslt/crashtests/crashtests.list    | 30 +++++++++++++++++++++
 40 files changed, 627 insertions(+)
 create mode 100644 dom/xslt/crashtests/1089049.html
 create mode 100644 dom/xslt/crashtests/111994.xml
 create mode 100644 dom/xslt/crashtests/111994.xsl
 create mode 100644 dom/xslt/crashtests/1205163.xml
 create mode 100644 dom/xslt/crashtests/1205163.xsl
 create mode 100644 dom/xslt/crashtests/1243337.xml
 create mode 100644 dom/xslt/crashtests/1243337.xsl
 create mode 100644 dom/xslt/crashtests/1330492.html
 create mode 100644 dom/xslt/crashtests/1336828.html
 create mode 100644 dom/xslt/crashtests/1336830.html
 create mode 100644 dom/xslt/crashtests/1336832.html
 create mode 100644 dom/xslt/crashtests/1338277.html
 create mode 100644 dom/xslt/crashtests/1361892.html
 create mode 100644 dom/xslt/crashtests/1430818.sjs
 create mode 100644 dom/xslt/crashtests/1430818.xml
 create mode 100644 dom/xslt/crashtests/1527277.html
 create mode 100644 dom/xslt/crashtests/1589930.xml
 create mode 100644 dom/xslt/crashtests/182460-select.xml
 create mode 100644 dom/xslt/crashtests/182460-selects.xsl
 create mode 100644 dom/xslt/crashtests/182460-table.xhtml
 create mode 100644 dom/xslt/crashtests/226425.xml
 create mode 100644 dom/xslt/crashtests/226425.xsl
 create mode 100644 dom/xslt/crashtests/406106-1.html
 create mode 100644 dom/xslt/crashtests/483444.xml
 create mode 100644 dom/xslt/crashtests/485217.xml
 create mode 100644 dom/xslt/crashtests/485217.xsl
 create mode 100644 dom/xslt/crashtests/485286.xml
 create mode 100644 dom/xslt/crashtests/527558_1.xml
 create mode 100644 dom/xslt/crashtests/528300.xml
 create mode 100644 dom/xslt/crashtests/528488.xml
 create mode 100644 dom/xslt/crashtests/528963.xml
 create mode 100644 dom/xslt/crashtests/545927.html
 create mode 100644 dom/xslt/crashtests/601543.html
 create mode 100644 dom/xslt/crashtests/602115.html
 create mode 100644 dom/xslt/crashtests/603844.html
 create mode 100644 dom/xslt/crashtests/667315.xml
 create mode 100644 dom/xslt/crashtests/91332.xml
 create mode 100644 dom/xslt/crashtests/91332.xsl
 create mode 100644 dom/xslt/crashtests/949990.html
 create mode 100644 dom/xslt/crashtests/crashtests.list

(limited to 'dom/xslt/crashtests')

diff --git a/dom/xslt/crashtests/1089049.html b/dom/xslt/crashtests/1089049.html
new file mode 100644
index 0000000000..84ef6494c3
--- /dev/null
+++ b/dom/xslt/crashtests/1089049.html
@@ -0,0 +1,3 @@
+<script>
+var xpathResult = document.evaluate('', null, null, XPathResult.FIRST_ORDERED_NODE_TYPE, null);
+</script>
diff --git a/dom/xslt/crashtests/111994.xml b/dom/xslt/crashtests/111994.xml
new file mode 100644
index 0000000000..ce7ffad2ac
--- /dev/null
+++ b/dom/xslt/crashtests/111994.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" standalone="yes" ?>
+<?xml-stylesheet type="text/xsl" href="111994.xsl" ?>
+<root>
+  <item id="1001" name="name" />
+</root>
diff --git a/dom/xslt/crashtests/111994.xsl b/dom/xslt/crashtests/111994.xsl
new file mode 100644
index 0000000000..4cf68179fa
--- /dev/null
+++ b/dom/xslt/crashtests/111994.xsl
@@ -0,0 +1,13 @@
+<?xml version="1.0" ?>
+<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
+  <xsl:template match="root">
+    <html><body><xsl:apply-templates select="item" /></body></html>
+  </xsl:template>
+  <xsl:template match="item">
+    <img>
+      <xsl:attribute name="src">
+        <xsl:value-of select="@name" />
+      </xsl:attribute>
+    </img>
+  </xsl:template>
+</xsl:stylesheet>
diff --git a/dom/xslt/crashtests/1205163.xml b/dom/xslt/crashtests/1205163.xml
new file mode 100644
index 0000000000..2d450a1d50
--- /dev/null
+++ b/dom/xslt/crashtests/1205163.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xsl" href="1205163.xsl"?>
+<result>
+  <Title>Example</Title>
+  <Error>Error</Error>
+</result>
diff --git a/dom/xslt/crashtests/1205163.xsl b/dom/xslt/crashtests/1205163.xsl
new file mode 100644
index 0000000000..f0bbb5cb95
--- /dev/null
+++ b/dom/xslt/crashtests/1205163.xsl
@@ -0,0 +1,11 @@
+<?xml version="1.0"?>
+<xsl:stylesheet version="1.0"
+   xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+  <xsl:output method="text"/>
+  <xsl:template match="node()|@*">
+    <xsl:copy>
+      <xsl:apply-templates select="node()|@*"/>
+    </xsl:copy>
+  </xsl:template>
+  <xsl:template match="Error"/>
+</xsl:stylesheet>
diff --git a/dom/xslt/crashtests/1243337.xml b/dom/xslt/crashtests/1243337.xml
new file mode 100644
index 0000000000..40f5e3a35d
--- /dev/null
+++ b/dom/xslt/crashtests/1243337.xml
@@ -0,0 +1,3 @@
+<?xml version="1.0" standalone="yes" ?>
+<?xml-stylesheet type="text/xsl" href="1243337.xsl" ?>
+<root/>
diff --git a/dom/xslt/crashtests/1243337.xsl b/dom/xslt/crashtests/1243337.xsl
new file mode 100644
index 0000000000..0e659bf900
--- /dev/null
+++ b/dom/xslt/crashtests/1243337.xsl
@@ -0,0 +1,6 @@
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+ <xsl:template match="/">
+  <xsl:value-of select="generate-id(5)"/>
+  <html><body/></html>
+ </xsl:template>
+</xsl:stylesheet>
diff --git a/dom/xslt/crashtests/1330492.html b/dom/xslt/crashtests/1330492.html
new file mode 100644
index 0000000000..a19c646a17
--- /dev/null
+++ b/dom/xslt/crashtests/1330492.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<meta charset="UTF-8">
+<script id=o_xml type="text/plain"><?xml version="1.0" encoding="UTF-8"?>
+<ffsy></ffsy>
+</script>
+<script id=o_xslt type="text/plain"><?xml version="1.0" encoding="UTF-8"?>
+<xsl:transform xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
+  <xsl:output method="text" />
+</xsl:transform>
+</script>
+<script>
+addEventListener("DOMContentLoaded", function(){
+  let doc = new DOMParser();
+  let xml = doc.parseFromString(o_xml.textContent, "text/xml");
+  let xsltPrs = new XSLTProcessor();
+  let xsl = doc.parseFromString(o_xslt.textContent, "text/xml");
+  xsltPrs.importStylesheet(xsl);
+  xsltPrs.transformToFragment(xml, document);
+  xsltPrs.transformToDocument(xml);
+});
+</script>
+</html>
diff --git a/dom/xslt/crashtests/1336828.html b/dom/xslt/crashtests/1336828.html
new file mode 100644
index 0000000000..3f25e23e03
--- /dev/null
+++ b/dom/xslt/crashtests/1336828.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script id=o_xml type="text/plain"><?xml version="1.0" encoding="UTF-8"?>
+<tag_name/>
+</script>
+<script id=o_xslt type="text/plain"><?xml version="1.0" encoding="UTF-8"?>
+<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="42">
+ <xsl:variable name="var_name"><xsl:template/></xsl:variable>
+ <xsl:template match="tag_name[$var_name]"/>
+</xsl:stylesheet>
+</script>
+<script>
+window.onload = function(){
+  let doc = new DOMParser(), proc = new XSLTProcessor();
+  proc.importStylesheet(doc.parseFromString(document.getElementById('o_xslt').textContent, "text/xml"));
+  proc.transformToDocument(doc.parseFromString(document.getElementById('o_xml').textContent, "text/xml"));
+};
+</script>
+</head>
+</html>
diff --git a/dom/xslt/crashtests/1336830.html b/dom/xslt/crashtests/1336830.html
new file mode 100644
index 0000000000..907f589563
--- /dev/null
+++ b/dom/xslt/crashtests/1336830.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script id=o_xml type="text/plain"><?xml version="1.0" encoding="UTF-8"?>
+<tag_name/>
+</script>
+<script id=o_xslt type="text/plain"><?xml version="1.0" encoding="UTF-8"?>
+<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="42">
+  <xsl:template match="*">
+    <xsl:apply-imports/>
+    <xsl:apply-templates select=".">
+      <xsl:with-param name="whatever_1">whatever_2</xsl:with-param>
+    </xsl:apply-templates>
+  </xsl:template>
+</xsl:stylesheet>
+</script>
+<script>
+window.onload = function(){
+  setTimeout(function(){ window.close(); }, 400);
+  let doc = new DOMParser(), proc = new XSLTProcessor();
+  proc.importStylesheet(doc.parseFromString(document.getElementById('o_xslt').textContent, "text/xml"));
+  proc.transformToFragment(doc.parseFromString(document.getElementById('o_xml').textContent, "text/xml"), document);
+};
+</script>
+</head>
+</html>
diff --git a/dom/xslt/crashtests/1336832.html b/dom/xslt/crashtests/1336832.html
new file mode 100644
index 0000000000..0fb9033d1a
--- /dev/null
+++ b/dom/xslt/crashtests/1336832.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script id=o_xml type="text/plain"><?xml version="1.0" encoding="UTF-8"?>
+<tag_name/>
+</script>
+<script id=o_xslt type="text/plain"><?xml version="1.0" encoding="UTF-8"?>
+<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
+  <xsl:variable name="var_1">
+    <xsl:for-each select="/">
+      <xsl:value-of select="count()"/>
+    </xsl:for-each>
+  </xsl:variable>
+  <xsl:template match="/">
+    <xsl:value-of select="//*[1 = $var_1]"/>
+  </xsl:template>
+</xsl:stylesheet>
+</script>
+<script>
+window.onload = function(){
+  let doc = new DOMParser(), proc = new XSLTProcessor();
+  proc.importStylesheet(doc.parseFromString(document.getElementById('o_xslt').textContent, "text/xml"));
+  proc.transformToDocument(doc.parseFromString(document.getElementById('o_xml').textContent, "text/xml"));
+};
+</script>
+</head>
+</html>
diff --git a/dom/xslt/crashtests/1338277.html b/dom/xslt/crashtests/1338277.html
new file mode 100644
index 0000000000..d928819c75
--- /dev/null
+++ b/dom/xslt/crashtests/1338277.html
@@ -0,0 +1,21 @@
+<script id=o_xml type="text/plain"><?xml version="1.0" encoding="UTF-8"?>
+<xb></xb>
+</script>
+<script id=o_xslt type="text/plain"><?xml version="1.0" encoding="UTF-8"?>
+<xsl:transform version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+  <xsl:template match="xb[$v1]"></xsl:template>
+  <xsl:variable name="v1">
+    <xsl:attribute name="a1" namespace="z">
+      <xsl:variable name="v2" select="$v2"></xsl:variable>
+    </xsl:attribute>
+  </xsl:variable>
+</xsl:transform>
+</script>
+<script>
+addEventListener("DOMContentLoaded", function(){
+  let doc = new DOMParser();
+  let xsltPrs = new XSLTProcessor();
+  xsltPrs.importStylesheet(doc.parseFromString(o_xslt.textContent, "text/xml"));
+  xsltPrs.transformToDocument(doc.parseFromString(o_xml.textContent, "text/xml"));
+});
+</script>
diff --git a/dom/xslt/crashtests/1361892.html b/dom/xslt/crashtests/1361892.html
new file mode 100644
index 0000000000..a7befd2c42
--- /dev/null
+++ b/dom/xslt/crashtests/1361892.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+	<head>
+		<meta charset="UTF-8">
+		<script id=o_xml type="text/plain"><?xml version="1.0" encoding="UTF-8"?>
+<tag_name/>
+		</script>
+		<script id=o_xslt type="text/plain"><?xml version="1.0" encoding="UTF-8"?>
+<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="42">
+  <xsl:template match="*">
+    <xsl:value-of xmlns:regexp="http://exslt.org/regular-expressions" select="regexp:match('foo','bar','-2')"/>
+  </xsl:template>
+</xsl:stylesheet>
+		</script>
+		<script>
+window.onload = function(){
+	  let doc = new DOMParser(), proc = new XSLTProcessor();
+	    proc.importStylesheet(doc.parseFromString(document.getElementById('o_xslt').textContent, "text/xml"));
+	      proc.transformToDocument(doc.parseFromString(document.getElementById('o_xml').textContent, "text/xml"));
+};
+		</script>
+	</head>
+</html>
diff --git a/dom/xslt/crashtests/1430818.sjs b/dom/xslt/crashtests/1430818.sjs
new file mode 100644
index 0000000000..a1c9f1e662
--- /dev/null
+++ b/dom/xslt/crashtests/1430818.sjs
@@ -0,0 +1,49 @@
+function getFileStream(filename)
+{
+  let self = Components.classes["@mozilla.org/file/local;1"]
+                       .createInstance(Components.interfaces.nsIFile);
+  self.initWithPath(getState("__LOCATION__"));
+  let file = self.parent;
+  file.append(filename);
+  let stream  = Components.classes['@mozilla.org/network/file-input-stream;1']
+                          .createInstance(Components.interfaces.nsIFileInputStream);
+  stream.init(file, -1, -1, false);
+  return stream;
+}
+
+function handleRequest(request, response)
+{
+  response.processAsync();
+  response.setStatusLine(null, 200, "OK");
+  response.setHeader("Content-Type", "text/xml", false);
+
+  switch (request.queryString) {
+    case "stylesheet":
+    {
+      let timer = Components.classes["@mozilla.org/timer;1"]
+                            .createInstance(Components.interfaces.nsITimer);
+      timer.initWithCallback(() => {
+        setState("xslt", "loaded");
+        response.finish();
+        timer.cancel();
+      }, 1000 /* milliseconds */, Components.interfaces.nsITimer.TYPE_REPEATING_SLACK);
+      break;
+    }
+    default:
+    {
+      let stream = getFileStream("1430818.xml");
+      response.bodyOutputStream.writeFrom(stream,
+                                          stream.available());
+      stream.close();
+      let timer = Components.classes["@mozilla.org/timer;1"]
+                            .createInstance(Components.interfaces.nsITimer);
+      timer.initWithCallback(() => {
+        if (getState("xslt") == "loaded") {
+          response.finish();
+          timer.cancel();
+        }
+      }, 100 /* milliseconds */, Components.interfaces.nsITimer.TYPE_REPEATING_SLACK);
+      break;
+    }
+  }
+}
diff --git a/dom/xslt/crashtests/1430818.xml b/dom/xslt/crashtests/1430818.xml
new file mode 100644
index 0000000000..95731bcb0b
--- /dev/null
+++ b/dom/xslt/crashtests/1430818.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xsl" href="?stylesheet"?>
+<root>
+</root>
diff --git a/dom/xslt/crashtests/1527277.html b/dom/xslt/crashtests/1527277.html
new file mode 100644
index 0000000000..ef437803c9
--- /dev/null
+++ b/dom/xslt/crashtests/1527277.html
@@ -0,0 +1,14 @@
+<html>
+<script>
+var xml = "<e/>";
+var xsl = "<xsl:stylesheet version=\"1.0\" xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\"><xsl:decimal-format grouping-separator=\".\" /><xsl:template match=\"/\"><xsl:value-of select=\"format-number(0.1, '.#')\"/></xsl:template></xsl:stylesheet>";
+
+var parser = new DOMParser();
+var xmlDoc = parser.parseFromString(xml, "text/xml");
+var xslDoc = parser.parseFromString(xsl, "text/xml");
+
+xsltProcessor = new XSLTProcessor();
+xsltProcessor.importStylesheet(xslDoc);
+var result = xsltProcessor.transformToDocument(xmlDoc);
+</script>
+</html>
diff --git a/dom/xslt/crashtests/1589930.xml b/dom/xslt/crashtests/1589930.xml
new file mode 100644
index 0000000000..74d4cc8463
--- /dev/null
+++ b/dom/xslt/crashtests/1589930.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xsl" href="#stylesheet"?>
+<!DOCTYPE root [
+  <!ATTLIST xsl:stylesheet id ID #IMPLIED>
+]>
+<root>
+<xsl:stylesheet id="stylesheet" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
+  <xsl:template match="/"><xsl:value-of select="format-number(99.98, '0.0')"/></xsl:template>
+</xsl:stylesheet>
+</root>
diff --git a/dom/xslt/crashtests/182460-select.xml b/dom/xslt/crashtests/182460-select.xml
new file mode 100644
index 0000000000..bb9f79b040
--- /dev/null
+++ b/dom/xslt/crashtests/182460-select.xml
@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<?xml-stylesheet type="text/xsl" href="182460-selects.xsl"?>
+<fud/>
\ No newline at end of file
diff --git a/dom/xslt/crashtests/182460-selects.xsl b/dom/xslt/crashtests/182460-selects.xsl
new file mode 100644
index 0000000000..f083ea31fe
--- /dev/null
+++ b/dom/xslt/crashtests/182460-selects.xsl
@@ -0,0 +1,5 @@
+<html>
+<body>
+hi
+</body>
+</html>
diff --git a/dom/xslt/crashtests/182460-table.xhtml b/dom/xslt/crashtests/182460-table.xhtml
new file mode 100644
index 0000000000..1bf2a23cb4
--- /dev/null
+++ b/dom/xslt/crashtests/182460-table.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title>XSL Crash</title>
+</head>
+<body>
+<iframe src="182460-select.xml"></iframe>
+<script type="text/javascript" src="data:text/javascript,/*no code*/"/>
+</body>
+</html>
diff --git a/dom/xslt/crashtests/226425.xml b/dom/xslt/crashtests/226425.xml
new file mode 100644
index 0000000000..c6662cfe2c
--- /dev/null
+++ b/dom/xslt/crashtests/226425.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<?xml-stylesheet type="text/xsl" href="226425.xsl" ?>
+
+<text></text>
diff --git a/dom/xslt/crashtests/226425.xsl b/dom/xslt/crashtests/226425.xsl
new file mode 100644
index 0000000000..ddb61ae680
--- /dev/null
+++ b/dom/xslt/crashtests/226425.xsl
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+<xsl:output method="html" indent="yes"/>
+
+<xsl:template match="/">
+<html><body>
+<xsl:apply-templates select="document('dontmatter')"/>
+</body></html>
+</xsl:template>
+</xsl:stylesheet>
diff --git a/dom/xslt/crashtests/406106-1.html b/dom/xslt/crashtests/406106-1.html
new file mode 100644
index 0000000000..86ab510ff8
--- /dev/null
+++ b/dom/xslt/crashtests/406106-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var p = new XSLTProcessor();
+  p.setParameter("a", "b", {e: p});
+}
+
+boom();
+
+</script>
+</head>
+<body>
+</body>
+</html>
diff --git a/dom/xslt/crashtests/483444.xml b/dom/xslt/crashtests/483444.xml
new file mode 100644
index 0000000000..18fffceba5
--- /dev/null
+++ b/dom/xslt/crashtests/483444.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xsl" href="#stylesheet"?>
+<!DOCTYPE root [
+  <!ATTLIST xsl:stylesheet id ID #IMPLIED>
+]>
+<root>
+<xsl:stylesheet id="stylesheet" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
+  <xsl:attribute-set name="a">
+	<xsl:attribute name="b">c</xsl:attribute>
+  </xsl:attribute-set>
+  <xsl:template match="/">
+    <b>Please output something!</b>
+  </xsl:template>
+  <xsl:attribute-set name="a">
+	<xsl:attribute name="b">c</xsl:attribute>
+  </xsl:attribute-set>
+</xsl:stylesheet>
+<doc id="foo">this</doc>
+</root>
diff --git a/dom/xslt/crashtests/485217.xml b/dom/xslt/crashtests/485217.xml
new file mode 100644
index 0000000000..93a20e4f77
--- /dev/null
+++ b/dom/xslt/crashtests/485217.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<?xml-stylesheet type="text/xsl" href="485217.xsl"?>
+
+
+<root xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+    <item1 id="AAAAAAA" />
+    <item2 id="AAAAAAAAA" label="AAAAAAAAAAAA"/>
+</root>
diff --git a/dom/xslt/crashtests/485217.xsl b/dom/xslt/crashtests/485217.xsl
new file mode 100644
index 0000000000..2935c5a41b
--- /dev/null
+++ b/dom/xslt/crashtests/485217.xsl
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<xsl:stylesheet version="2.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+
+    <xsl:key name="label" match="item2" use="undeclaredfunc()"/>
+
+    <xsl:template match="root">
+                    <xsl:for-each select="//item1">
+                        <xsl:call-template name="item1" />
+                    </xsl:for-each>
+    </xsl:template>
+
+    <xsl:template name="item1">
+                <xsl:for-each select="key('label', 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA')">
+                </xsl:for-each>
+    </xsl:template>
+
+</xsl:stylesheet>
diff --git a/dom/xslt/crashtests/485286.xml b/dom/xslt/crashtests/485286.xml
new file mode 100644
index 0000000000..c87aa940ef
--- /dev/null
+++ b/dom/xslt/crashtests/485286.xml
@@ -0,0 +1,12 @@
+<?xml-stylesheet type="application/xml" href="485286.xml"?>
+<transform xmlns="http://www.w3.org/1999/XSL/Transform" version="1.0">
+  <variable name="v">
+    <for-each select="/">
+      <value-of select="count(1)"/>
+    </for-each>
+  </variable>
+  <key name="k" match="/" use="$v"/>
+  <template match="/">
+    <value-of select="key('k', /..)"/>
+  </template>
+</transform>
diff --git a/dom/xslt/crashtests/527558_1.xml b/dom/xslt/crashtests/527558_1.xml
new file mode 100644
index 0000000000..ebb6c3d533
--- /dev/null
+++ b/dom/xslt/crashtests/527558_1.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xml" href="#bug"?>
+<!DOCTYPE doc [
+<!ATTLIST xsl:transform
+  id	ID	#REQUIRED>
+]>
+<doc>
+<xsl:transform id="bug"
+                version="2.0"
+                xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+  <xsl:key name="k0" match="e1" use="key('k0', 'foobar')" /> 
+  <xsl:template id="t1" name="t1" match="key('k0', '1/2/2003')" />
+</xsl:transform>
+
+<e1 a1="foobar" a2="foobar"/>
+
+</doc>
diff --git a/dom/xslt/crashtests/528300.xml b/dom/xslt/crashtests/528300.xml
new file mode 100644
index 0000000000..8902bb373e
--- /dev/null
+++ b/dom/xslt/crashtests/528300.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xml" href="#bug"?>
+<!DOCTYPE doc [
+<!ATTLIST xsl:transform
+  id	ID	#REQUIRED>
+]>
+<doc>
+<xsl:transform
+  xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+  version="2.0"
+  id="bug">
+  <xsl:variable name="v0">
+    <xsl:for-each select="$v0" />
+  </xsl:variable>
+  <xsl:template name="t2" match="/">
+    <xsl:copy-of select="number($v0)" />
+  </xsl:template>
+</xsl:transform>
+
+<e1 />
+
+</doc>
diff --git a/dom/xslt/crashtests/528488.xml b/dom/xslt/crashtests/528488.xml
new file mode 100644
index 0000000000..904b345612
--- /dev/null
+++ b/dom/xslt/crashtests/528488.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xml" href="#bug"?>
+<!DOCTYPE doc [
+<!ATTLIST xsl:transform
+  id	ID	#REQUIRED>
+]>
+<doc>
+  <xsl:transform 
+    xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+    xmlns:exslstrings="http://exslt.org/strings"
+    version="2.0"
+    id="bug">
+    <xsl:variable name="v0" select="$v0" /> 
+    <xsl:template name="t2" match="/">
+      <xsl:param name="p0" select="exslstrings:tokenize('1234','foobar')" />
+      <xsl:copy-of select="round($v0)" /> 
+    </xsl:template>
+  </xsl:transform>
+</doc>
diff --git a/dom/xslt/crashtests/528963.xml b/dom/xslt/crashtests/528963.xml
new file mode 100644
index 0000000000..d855e75634
--- /dev/null
+++ b/dom/xslt/crashtests/528963.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xml" href="#bug"?>
+<!DOCTYPE doc [
+<!ATTLIST xsl:transform
+  id	ID	#REQUIRED>
+]>
+<doc>
+  <xsl:transform 
+    xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+    version="2.0"
+    id="bug">
+    <xsl:key name="k0" match="e2" use="name('foo')" /> 
+
+    <xsl:template name="t1" match="/">
+      <xsl:element name="e2" namespace="{//doc}" />
+    </xsl:template>
+    <xsl:template name="t2" match="key('k0', 'bar')" />
+  </xsl:transform>
+  
+  <e2/>
+  
+</doc>
diff --git a/dom/xslt/crashtests/545927.html b/dom/xslt/crashtests/545927.html
new file mode 100644
index 0000000000..0a9010e21e
--- /dev/null
+++ b/dom/xslt/crashtests/545927.html
@@ -0,0 +1,28 @@
+<html>
+<head>
+<script>
+function main()
+{
+	xml=document.implementation.createDocument('', '', null);
+	xml.appendChild(doc=xml.createElement('root'));
+
+	var p = new DOMParser();
+	text  = '<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">';
+	text += '<xsl:template match="/">';
+	text += '<body>';
+	text += '<xsl:number value="2147483648" format="i"/>';
+	text += '</body>';
+	text += '</xsl:template>';	
+	text += '</xsl:stylesheet>';
+	xsl=p.parseFromString(text, 'text/xml');
+
+	xsltProcessor=new XSLTProcessor();
+	xsltProcessor.importStylesheet(xsl);
+	d = xsltProcessor.transformToFragment(xml, document);
+}
+</script>
+</head>
+<body onload="main()">
+</body>
+</html>
+
diff --git a/dom/xslt/crashtests/601543.html b/dom/xslt/crashtests/601543.html
new file mode 100644
index 0000000000..af025b242a
--- /dev/null
+++ b/dom/xslt/crashtests/601543.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+(new XSLTProcessor).setParameter('', '', [{}, null]);
+</script>
diff --git a/dom/xslt/crashtests/602115.html b/dom/xslt/crashtests/602115.html
new file mode 100644
index 0000000000..ad42d76a05
--- /dev/null
+++ b/dom/xslt/crashtests/602115.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<script>
+
+try {
+  var docType = document.implementation.createDocumentType(undefined, '', '');
+  var doc = document.implementation.createDocument('', '', null);
+  var xp = new XSLTProcessor;
+  xp.importStylesheet(doc);
+  xp.transformToDocument(docType);
+}
+catch (ex) {}
+
+try {
+  docType = document.implementation.createDocumentType(undefined, '', '');
+  doc = document.implementation.createDocument('', '', null);
+  xp = new XSLTProcessor;
+  xp.importStylesheet(doc);
+  xp.transformToFragment(docType, document);
+}
+catch (ex) {}
+
+</script>
diff --git a/dom/xslt/crashtests/603844.html b/dom/xslt/crashtests/603844.html
new file mode 100644
index 0000000000..f576effdb6
--- /dev/null
+++ b/dom/xslt/crashtests/603844.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+  var frame = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
+  frame.onload = y; 
+  frame.src = "data:text/plain,0"; 
+  document.body.appendChild(frame);
+  frameDoc = frame.contentDocument;
+
+  function y()
+  {
+    frameDoc.removeChild(frameDoc.documentElement);
+
+    var xp = new XSLTProcessor;
+    xp.importStylesheet(frameDoc);
+    try {
+      xp.transformToDocument(frameDoc.createTextNode('x'));
+    } catch(e) { }
+
+    document.documentElement.removeAttribute("class");
+  }
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/xslt/crashtests/667315.xml b/dom/xslt/crashtests/667315.xml
new file mode 100644
index 0000000000..7a560ba3bd
--- /dev/null
+++ b/dom/xslt/crashtests/667315.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xsl" href="#stylesheet"?>
+<!DOCTYPE root [
+  <!ATTLIST xsl:stylesheet id ID #IMPLIED>
+]>
+<root>
+<xsl:stylesheet id="stylesheet" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
+  <xsl:variable name="var"><p>a</p></xsl:variable>
+  <xsl:template match="/"><xsl:copy-of select="$var" /></xsl:template>
+</xsl:stylesheet>
+</root>
diff --git a/dom/xslt/crashtests/91332.xml b/dom/xslt/crashtests/91332.xml
new file mode 100644
index 0000000000..c5a463c8a9
--- /dev/null
+++ b/dom/xslt/crashtests/91332.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" standalone="yes" ?>
+<?xml-stylesheet type="text/xsl" href="91332.xsl" ?>
+<root>
+  <category name="Rectangles">
+    <list item="square" />
+  </category>
+  <quad id="square">
+    <desc>A square is ...</desc>
+  </quad>
+</root>
diff --git a/dom/xslt/crashtests/91332.xsl b/dom/xslt/crashtests/91332.xsl
new file mode 100644
index 0000000000..7d01df22b6
--- /dev/null
+++ b/dom/xslt/crashtests/91332.xsl
@@ -0,0 +1,21 @@
+<?xml version="1.0" ?>
+<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
+
+  <xsl:key name="polyList" match="quad" use="@id" />
+
+  <xsl:template match="root">
+    <html><body><xsl:apply-templates select="category" /></body></html>
+  </xsl:template>
+
+  <xsl:template match="category">
+    <table><xsl:apply-templates select="list" /></table>
+  </xsl:template>
+
+  <xsl:template match="list">
+    <tr><td><xsl:apply-templates select="key('polyList',@item)" /></td></tr>
+  </xsl:template>
+
+  <xsl:template match="quad">
+    <b>Please output something!</b>
+  </xsl:template>
+</xsl:stylesheet>
diff --git a/dom/xslt/crashtests/949990.html b/dom/xslt/crashtests/949990.html
new file mode 100644
index 0000000000..23868e4db3
--- /dev/null
+++ b/dom/xslt/crashtests/949990.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom() {
+    document.evaluate("a", document.documentElement, null, 4096, null);
+}
+
+</script>
+</head>
+
+<body onload="boom()"></body>
+</html>
diff --git a/dom/xslt/crashtests/crashtests.list b/dom/xslt/crashtests/crashtests.list
new file mode 100644
index 0000000000..711f357862
--- /dev/null
+++ b/dom/xslt/crashtests/crashtests.list
@@ -0,0 +1,30 @@
+load 91332.xml
+load 111994.xml
+load 182460-table.xhtml
+load 226425.xml
+load 406106-1.html
+load 483444.xml
+load 485217.xml
+load 485286.xml
+load 527558_1.xml
+load 528300.xml
+load 528488.xml
+load 528963.xml
+load 545927.html
+load 601543.html
+load 602115.html
+load 603844.html
+load 667315.xml
+load 949990.html
+load 1089049.html
+load 1205163.xml
+load 1243337.xml
+load 1330492.html
+load 1336828.html
+load 1336830.html
+load 1336832.html
+load 1338277.html
+load 1361892.html
+load 1527277.html
+load 1589930.xml
+HTTP load 1430818.sjs
-- 
cgit v1.2.3