diff options
author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 19:33:14 +0000 |
---|---|---|
committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 19:33:14 +0000 |
commit | 36d22d82aa202bb199967e9512281e9a53db42c9 (patch) | |
tree | 105e8c98ddea1c1e4784a60a5a6410fa416be2de /dom/bindings/crashtests | |
parent | Initial commit. (diff) | |
download | firefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.tar.xz firefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.zip |
Adding upstream version 115.7.0esr.upstream/115.7.0esr
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'dom/bindings/crashtests')
-rw-r--r-- | dom/bindings/crashtests/1010658-1.html | 16 | ||||
-rw-r--r-- | dom/bindings/crashtests/1010658-2.html | 16 | ||||
-rw-r--r-- | dom/bindings/crashtests/769464.html | 11 | ||||
-rw-r--r-- | dom/bindings/crashtests/822340-1.html | 11 | ||||
-rw-r--r-- | dom/bindings/crashtests/822340-2.html | 8 | ||||
-rw-r--r-- | dom/bindings/crashtests/832899.html | 5 | ||||
-rw-r--r-- | dom/bindings/crashtests/860551.html | 4 | ||||
-rw-r--r-- | dom/bindings/crashtests/860591.html | 20 | ||||
-rw-r--r-- | dom/bindings/crashtests/862092.html | 19 | ||||
-rw-r--r-- | dom/bindings/crashtests/862610.html | 20 | ||||
-rw-r--r-- | dom/bindings/crashtests/869038.html | 22 | ||||
-rw-r--r-- | dom/bindings/crashtests/949940.html | 16 | ||||
-rw-r--r-- | dom/bindings/crashtests/crashtests.list | 13 | ||||
-rw-r--r-- | dom/bindings/crashtests/stringbuffer-USVString.html | 11 |
14 files changed, 192 insertions, 0 deletions
diff --git a/dom/bindings/crashtests/1010658-1.html b/dom/bindings/crashtests/1010658-1.html new file mode 100644 index 0000000000..6b341f4ed9 --- /dev/null +++ b/dom/bindings/crashtests/1010658-1.html @@ -0,0 +1,16 @@ +<!DOCTYPE html> +<html> +<head> +<script> +function boom() +{ + window.__proto__ = null; + for (var i = 0; i < 10000; ++i) { + self.document; + } +} + +</script></head> + +<body onload="boom();"></body> +</html> diff --git a/dom/bindings/crashtests/1010658-2.html b/dom/bindings/crashtests/1010658-2.html new file mode 100644 index 0000000000..cf473c3dd9 --- /dev/null +++ b/dom/bindings/crashtests/1010658-2.html @@ -0,0 +1,16 @@ +<!DOCTYPE html> +<html> +<head> +<script> +function boom() +{ + window.__proto__ = function(){}; + for (var i = 0; i < 10000; ++i) { + self.document; + } +} + +</script></head> + +<body onload="boom();"></body> +</html> diff --git a/dom/bindings/crashtests/769464.html b/dom/bindings/crashtests/769464.html new file mode 100644 index 0000000000..d075ee66a0 --- /dev/null +++ b/dom/bindings/crashtests/769464.html @@ -0,0 +1,11 @@ +<!DOCTYPE html> +<script> + +function boom() +{ + window.getComputedStyle(new Worker("404.js")); +} + +window.addEventListener("load", boom); + +</script> diff --git a/dom/bindings/crashtests/822340-1.html b/dom/bindings/crashtests/822340-1.html new file mode 100644 index 0000000000..4c8f6ae460 --- /dev/null +++ b/dom/bindings/crashtests/822340-1.html @@ -0,0 +1,11 @@ +<!DOCTYPE html> +<script> + var xhr = new XMLHttpRequest; + function f() { + var x = xhr.getResponseHeader; + x("abc"); + } + for (var i = 0; i < 20000; ++i) { + try { f(); } catch (e) {} + } +</script> diff --git a/dom/bindings/crashtests/822340-2.html b/dom/bindings/crashtests/822340-2.html new file mode 100644 index 0000000000..e938c91aac --- /dev/null +++ b/dom/bindings/crashtests/822340-2.html @@ -0,0 +1,8 @@ +<!DOCTYPE html> +<script> + var l = document.getElementsByTagName("*"); + var count = 20000; + for (var i = 0; i < count; ++i) { + l.item(0); + } +</script> diff --git a/dom/bindings/crashtests/832899.html b/dom/bindings/crashtests/832899.html new file mode 100644 index 0000000000..c565ad00f4 --- /dev/null +++ b/dom/bindings/crashtests/832899.html @@ -0,0 +1,5 @@ +<!DOCTYPE html> +<script> + var ev = document.createEvent("Events"); + EventTarget.prototype.dispatchEvent.call(navigator.connection, ev); +</script> diff --git a/dom/bindings/crashtests/860551.html b/dom/bindings/crashtests/860551.html new file mode 100644 index 0000000000..5008e57396 --- /dev/null +++ b/dom/bindings/crashtests/860551.html @@ -0,0 +1,4 @@ +<!DOCTYPE html> +<script> +SVGZoomAndPan instanceof SVGZoomAndPan +</script> diff --git a/dom/bindings/crashtests/860591.html b/dom/bindings/crashtests/860591.html new file mode 100644 index 0000000000..565a729c4d --- /dev/null +++ b/dom/bindings/crashtests/860591.html @@ -0,0 +1,20 @@ +<!DOCTYPE html> +<html> +<head> +<script> + var timeEvent = document.createEvent('TimeEvent'); + var mutationEvent = document.createEvent('MutationEvents'); + mutationEvent.__proto__ = timeEvent; + mutationEvent.target; + + var mouseScrollEvent = document.createEvent("MouseScrollEvents"); + var mouseEvent = document.createEvent("MouseEvents"); + mouseEvent.__proto__ = mouseScrollEvent; + mouseEvent.relatedTarget; + + var uiEvent = document.createEvent("UIEvents"); + uiEvent.__proto__ = mouseScrollEvent; + uiEvent.rangeParent; +</script> +</head> +</html> diff --git a/dom/bindings/crashtests/862092.html b/dom/bindings/crashtests/862092.html new file mode 100644 index 0000000000..1b31775a97 --- /dev/null +++ b/dom/bindings/crashtests/862092.html @@ -0,0 +1,19 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> + +function boom() +{ + var frameDoc = document.getElementById("f").contentDocument; + frameDoc.adoptNode(document.createElement("select")); +} + +</script> +</head> + +<body onload="boom();"> +<iframe id="f"></iframe> +</body> +</html> diff --git a/dom/bindings/crashtests/862610.html b/dom/bindings/crashtests/862610.html new file mode 100644 index 0000000000..768871ad96 --- /dev/null +++ b/dom/bindings/crashtests/862610.html @@ -0,0 +1,20 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> + HTMLElement.prototype.__proto__ = new Proxy({}, {}); + try { + window.Image; + } finally { + // Restore our prototype so the test harnesses can deal with us + // We can't just assign to __proto__ because it lives on our proto chain + // and we messed that up. + var desc = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__"); + desc.set.call(HTMLElement.prototype, Element.prototype); + } +</script> +</head> + +<body></body> +</html> diff --git a/dom/bindings/crashtests/869038.html b/dom/bindings/crashtests/869038.html new file mode 100644 index 0000000000..dedb4dd4d7 --- /dev/null +++ b/dom/bindings/crashtests/869038.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> + +function boom() +{ + var frame = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe"); + document.body.appendChild(frame); + var frameDoc = frame.contentDocument; + frameDoc.contentEditable = "true"; + document.body.removeChild(frame); + SpecialPowers.gc(); + frameDoc.focus(); +} + +</script> +</head> + +<body onload="boom();"></body> +</html> diff --git a/dom/bindings/crashtests/949940.html b/dom/bindings/crashtests/949940.html new file mode 100644 index 0000000000..7f20085fea --- /dev/null +++ b/dom/bindings/crashtests/949940.html @@ -0,0 +1,16 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> +function boom() +{ + var frameWin = document.getElementById("f").contentWindow; + Object.create(frameWin).self; +} +</script> +</head> +<body onload="boom()"> +<iframe id="f" src="data:text/html,3"></iframe> +</body> +</html> diff --git a/dom/bindings/crashtests/crashtests.list b/dom/bindings/crashtests/crashtests.list new file mode 100644 index 0000000000..50126788cd --- /dev/null +++ b/dom/bindings/crashtests/crashtests.list @@ -0,0 +1,13 @@ +skip load 769464.html # bug 823822 - assert often leaks into other tests +load 822340-1.html +load 822340-2.html +load 832899.html +load 860551.html +load 860591.html +load 862092.html +load 862610.html +load 869038.html +load 949940.html +load 1010658-1.html +load 1010658-2.html +load stringbuffer-USVString.html diff --git a/dom/bindings/crashtests/stringbuffer-USVString.html b/dom/bindings/crashtests/stringbuffer-USVString.html new file mode 100644 index 0000000000..a193e732b9 --- /dev/null +++ b/dom/bindings/crashtests/stringbuffer-USVString.html @@ -0,0 +1,11 @@ +<!doctype html> +<script> + var div = document.createElement("div"); + // Need a long-enough string that when we get it from the DOM it will not get + // inlined and will be an external stringbuffer string. + var str = "http://" + (new Array(200).join("a")); + div.setAttribute("x", str); + str = div.getAttribute("x"); + // Now pass it as a USVString + new URL(str); +</script> |