diff options
| author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 19:33:14 +0000 |
|---|---|---|
| committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 19:33:14 +0000 |
| commit | 36d22d82aa202bb199967e9512281e9a53db42c9 (patch) | |
| tree | 105e8c98ddea1c1e4784a60a5a6410fa416be2de /dom/xslt/crashtests | |
| parent | Initial commit. (diff) | |
| download | firefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.tar.xz firefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.zip | |
Adding upstream version 115.7.0esr.upstream/115.7.0esr
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'dom/xslt/crashtests')
40 files changed, 627 insertions, 0 deletions
diff --git a/dom/xslt/crashtests/1089049.html b/dom/xslt/crashtests/1089049.html new file mode 100644 index 0000000000..84ef6494c3 --- /dev/null +++ b/dom/xslt/crashtests/1089049.html @@ -0,0 +1,3 @@ +<script> +var xpathResult = document.evaluate('', null, null, XPathResult.FIRST_ORDERED_NODE_TYPE, null); +</script> diff --git a/dom/xslt/crashtests/111994.xml b/dom/xslt/crashtests/111994.xml new file mode 100644 index 0000000000..ce7ffad2ac --- /dev/null +++ b/dom/xslt/crashtests/111994.xml @@ -0,0 +1,5 @@ +<?xml version="1.0" standalone="yes" ?>
+<?xml-stylesheet type="text/xsl" href="111994.xsl" ?>
+<root>
+ <item id="1001" name="name" />
+</root>
diff --git a/dom/xslt/crashtests/111994.xsl b/dom/xslt/crashtests/111994.xsl new file mode 100644 index 0000000000..4cf68179fa --- /dev/null +++ b/dom/xslt/crashtests/111994.xsl @@ -0,0 +1,13 @@ +<?xml version="1.0" ?>
+<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
+ <xsl:template match="root">
+ <html><body><xsl:apply-templates select="item" /></body></html>
+ </xsl:template>
+ <xsl:template match="item">
+ <img>
+ <xsl:attribute name="src">
+ <xsl:value-of select="@name" />
+ </xsl:attribute>
+ </img>
+ </xsl:template>
+</xsl:stylesheet>
diff --git a/dom/xslt/crashtests/1205163.xml b/dom/xslt/crashtests/1205163.xml new file mode 100644 index 0000000000..2d450a1d50 --- /dev/null +++ b/dom/xslt/crashtests/1205163.xml @@ -0,0 +1,6 @@ +<?xml version="1.0"?> +<?xml-stylesheet type="text/xsl" href="1205163.xsl"?> +<result> + <Title>Example</Title> + <Error>Error</Error> +</result> diff --git a/dom/xslt/crashtests/1205163.xsl b/dom/xslt/crashtests/1205163.xsl new file mode 100644 index 0000000000..f0bbb5cb95 --- /dev/null +++ b/dom/xslt/crashtests/1205163.xsl @@ -0,0 +1,11 @@ +<?xml version="1.0"?> +<xsl:stylesheet version="1.0" + xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> + <xsl:output method="text"/> + <xsl:template match="node()|@*"> + <xsl:copy> + <xsl:apply-templates select="node()|@*"/> + </xsl:copy> + </xsl:template> + <xsl:template match="Error"/> +</xsl:stylesheet> diff --git a/dom/xslt/crashtests/1243337.xml b/dom/xslt/crashtests/1243337.xml new file mode 100644 index 0000000000..40f5e3a35d --- /dev/null +++ b/dom/xslt/crashtests/1243337.xml @@ -0,0 +1,3 @@ +<?xml version="1.0" standalone="yes" ?> +<?xml-stylesheet type="text/xsl" href="1243337.xsl" ?> +<root/> diff --git a/dom/xslt/crashtests/1243337.xsl b/dom/xslt/crashtests/1243337.xsl new file mode 100644 index 0000000000..0e659bf900 --- /dev/null +++ b/dom/xslt/crashtests/1243337.xsl @@ -0,0 +1,6 @@ +<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> + <xsl:template match="/"> + <xsl:value-of select="generate-id(5)"/> + <html><body/></html> + </xsl:template> +</xsl:stylesheet> diff --git a/dom/xslt/crashtests/1330492.html b/dom/xslt/crashtests/1330492.html new file mode 100644 index 0000000000..a19c646a17 --- /dev/null +++ b/dom/xslt/crashtests/1330492.html @@ -0,0 +1,23 @@ +<!DOCTYPE html> +<html> +<meta charset="UTF-8"> +<script id=o_xml type="text/plain"><?xml version="1.0" encoding="UTF-8"?> +<ffsy></ffsy> +</script> +<script id=o_xslt type="text/plain"><?xml version="1.0" encoding="UTF-8"?> +<xsl:transform xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0"> + <xsl:output method="text" /> +</xsl:transform> +</script> +<script> +addEventListener("DOMContentLoaded", function(){ + let doc = new DOMParser(); + let xml = doc.parseFromString(o_xml.textContent, "text/xml"); + let xsltPrs = new XSLTProcessor(); + let xsl = doc.parseFromString(o_xslt.textContent, "text/xml"); + xsltPrs.importStylesheet(xsl); + xsltPrs.transformToFragment(xml, document); + xsltPrs.transformToDocument(xml); +}); +</script> +</html> diff --git a/dom/xslt/crashtests/1336828.html b/dom/xslt/crashtests/1336828.html new file mode 100644 index 0000000000..3f25e23e03 --- /dev/null +++ b/dom/xslt/crashtests/1336828.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script id=o_xml type="text/plain"><?xml version="1.0" encoding="UTF-8"?> +<tag_name/> +</script> +<script id=o_xslt type="text/plain"><?xml version="1.0" encoding="UTF-8"?> +<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="42"> + <xsl:variable name="var_name"><xsl:template/></xsl:variable> + <xsl:template match="tag_name[$var_name]"/> +</xsl:stylesheet> +</script> +<script> +window.onload = function(){ + let doc = new DOMParser(), proc = new XSLTProcessor(); + proc.importStylesheet(doc.parseFromString(document.getElementById('o_xslt').textContent, "text/xml")); + proc.transformToDocument(doc.parseFromString(document.getElementById('o_xml').textContent, "text/xml")); +}; +</script> +</head> +</html> diff --git a/dom/xslt/crashtests/1336830.html b/dom/xslt/crashtests/1336830.html new file mode 100644 index 0000000000..907f589563 --- /dev/null +++ b/dom/xslt/crashtests/1336830.html @@ -0,0 +1,27 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script id=o_xml type="text/plain"><?xml version="1.0" encoding="UTF-8"?> +<tag_name/> +</script> +<script id=o_xslt type="text/plain"><?xml version="1.0" encoding="UTF-8"?> +<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="42"> + <xsl:template match="*"> + <xsl:apply-imports/> + <xsl:apply-templates select="."> + <xsl:with-param name="whatever_1">whatever_2</xsl:with-param> + </xsl:apply-templates> + </xsl:template> +</xsl:stylesheet> +</script> +<script> +window.onload = function(){ + setTimeout(function(){ window.close(); }, 400); + let doc = new DOMParser(), proc = new XSLTProcessor(); + proc.importStylesheet(doc.parseFromString(document.getElementById('o_xslt').textContent, "text/xml")); + proc.transformToFragment(doc.parseFromString(document.getElementById('o_xml').textContent, "text/xml"), document); +}; +</script> +</head> +</html> diff --git a/dom/xslt/crashtests/1336832.html b/dom/xslt/crashtests/1336832.html new file mode 100644 index 0000000000..0fb9033d1a --- /dev/null +++ b/dom/xslt/crashtests/1336832.html @@ -0,0 +1,28 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script id=o_xml type="text/plain"><?xml version="1.0" encoding="UTF-8"?> +<tag_name/> +</script> +<script id=o_xslt type="text/plain"><?xml version="1.0" encoding="UTF-8"?> +<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0"> + <xsl:variable name="var_1"> + <xsl:for-each select="/"> + <xsl:value-of select="count()"/> + </xsl:for-each> + </xsl:variable> + <xsl:template match="/"> + <xsl:value-of select="//*[1 = $var_1]"/> + </xsl:template> +</xsl:stylesheet> +</script> +<script> +window.onload = function(){ + let doc = new DOMParser(), proc = new XSLTProcessor(); + proc.importStylesheet(doc.parseFromString(document.getElementById('o_xslt').textContent, "text/xml")); + proc.transformToDocument(doc.parseFromString(document.getElementById('o_xml').textContent, "text/xml")); +}; +</script> +</head> +</html> diff --git a/dom/xslt/crashtests/1338277.html b/dom/xslt/crashtests/1338277.html new file mode 100644 index 0000000000..d928819c75 --- /dev/null +++ b/dom/xslt/crashtests/1338277.html @@ -0,0 +1,21 @@ +<script id=o_xml type="text/plain"><?xml version="1.0" encoding="UTF-8"?> +<xb></xb> +</script> +<script id=o_xslt type="text/plain"><?xml version="1.0" encoding="UTF-8"?> +<xsl:transform version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> + <xsl:template match="xb[$v1]"></xsl:template> + <xsl:variable name="v1"> + <xsl:attribute name="a1" namespace="z"> + <xsl:variable name="v2" select="$v2"></xsl:variable> + </xsl:attribute> + </xsl:variable> +</xsl:transform> +</script> +<script> +addEventListener("DOMContentLoaded", function(){ + let doc = new DOMParser(); + let xsltPrs = new XSLTProcessor(); + xsltPrs.importStylesheet(doc.parseFromString(o_xslt.textContent, "text/xml")); + xsltPrs.transformToDocument(doc.parseFromString(o_xml.textContent, "text/xml")); +}); +</script> diff --git a/dom/xslt/crashtests/1361892.html b/dom/xslt/crashtests/1361892.html new file mode 100644 index 0000000000..a7befd2c42 --- /dev/null +++ b/dom/xslt/crashtests/1361892.html @@ -0,0 +1,23 @@ +<!DOCTYPE html> +<html> + <head> + <meta charset="UTF-8"> + <script id=o_xml type="text/plain"><?xml version="1.0" encoding="UTF-8"?> +<tag_name/> + </script> + <script id=o_xslt type="text/plain"><?xml version="1.0" encoding="UTF-8"?> +<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="42"> + <xsl:template match="*"> + <xsl:value-of xmlns:regexp="http://exslt.org/regular-expressions" select="regexp:match('foo','bar','-2')"/> + </xsl:template> +</xsl:stylesheet> + </script> + <script> +window.onload = function(){ + let doc = new DOMParser(), proc = new XSLTProcessor(); + proc.importStylesheet(doc.parseFromString(document.getElementById('o_xslt').textContent, "text/xml")); + proc.transformToDocument(doc.parseFromString(document.getElementById('o_xml').textContent, "text/xml")); +}; + </script> + </head> +</html> diff --git a/dom/xslt/crashtests/1430818.sjs b/dom/xslt/crashtests/1430818.sjs new file mode 100644 index 0000000000..a1c9f1e662 --- /dev/null +++ b/dom/xslt/crashtests/1430818.sjs @@ -0,0 +1,49 @@ +function getFileStream(filename) +{ + let self = Components.classes["@mozilla.org/file/local;1"] + .createInstance(Components.interfaces.nsIFile); + self.initWithPath(getState("__LOCATION__")); + let file = self.parent; + file.append(filename); + let stream = Components.classes['@mozilla.org/network/file-input-stream;1'] + .createInstance(Components.interfaces.nsIFileInputStream); + stream.init(file, -1, -1, false); + return stream; +} + +function handleRequest(request, response) +{ + response.processAsync(); + response.setStatusLine(null, 200, "OK"); + response.setHeader("Content-Type", "text/xml", false); + + switch (request.queryString) { + case "stylesheet": + { + let timer = Components.classes["@mozilla.org/timer;1"] + .createInstance(Components.interfaces.nsITimer); + timer.initWithCallback(() => { + setState("xslt", "loaded"); + response.finish(); + timer.cancel(); + }, 1000 /* milliseconds */, Components.interfaces.nsITimer.TYPE_REPEATING_SLACK); + break; + } + default: + { + let stream = getFileStream("1430818.xml"); + response.bodyOutputStream.writeFrom(stream, + stream.available()); + stream.close(); + let timer = Components.classes["@mozilla.org/timer;1"] + .createInstance(Components.interfaces.nsITimer); + timer.initWithCallback(() => { + if (getState("xslt") == "loaded") { + response.finish(); + timer.cancel(); + } + }, 100 /* milliseconds */, Components.interfaces.nsITimer.TYPE_REPEATING_SLACK); + break; + } + } +} diff --git a/dom/xslt/crashtests/1430818.xml b/dom/xslt/crashtests/1430818.xml new file mode 100644 index 0000000000..95731bcb0b --- /dev/null +++ b/dom/xslt/crashtests/1430818.xml @@ -0,0 +1,4 @@ +<?xml version="1.0"?> +<?xml-stylesheet type="text/xsl" href="?stylesheet"?> +<root> +</root> diff --git a/dom/xslt/crashtests/1527277.html b/dom/xslt/crashtests/1527277.html new file mode 100644 index 0000000000..ef437803c9 --- /dev/null +++ b/dom/xslt/crashtests/1527277.html @@ -0,0 +1,14 @@ +<html> +<script> +var xml = "<e/>"; +var xsl = "<xsl:stylesheet version=\"1.0\" xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\"><xsl:decimal-format grouping-separator=\".\" /><xsl:template match=\"/\"><xsl:value-of select=\"format-number(0.1, '.#')\"/></xsl:template></xsl:stylesheet>"; + +var parser = new DOMParser(); +var xmlDoc = parser.parseFromString(xml, "text/xml"); +var xslDoc = parser.parseFromString(xsl, "text/xml"); + +xsltProcessor = new XSLTProcessor(); +xsltProcessor.importStylesheet(xslDoc); +var result = xsltProcessor.transformToDocument(xmlDoc); +</script> +</html> diff --git a/dom/xslt/crashtests/1589930.xml b/dom/xslt/crashtests/1589930.xml new file mode 100644 index 0000000000..74d4cc8463 --- /dev/null +++ b/dom/xslt/crashtests/1589930.xml @@ -0,0 +1,10 @@ +<?xml version="1.0"?> +<?xml-stylesheet type="text/xsl" href="#stylesheet"?> +<!DOCTYPE root [ + <!ATTLIST xsl:stylesheet id ID #IMPLIED> +]> +<root> +<xsl:stylesheet id="stylesheet" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0"> + <xsl:template match="/"><xsl:value-of select="format-number(99.98, '0.0')"/></xsl:template> +</xsl:stylesheet> +</root> diff --git a/dom/xslt/crashtests/182460-select.xml b/dom/xslt/crashtests/182460-select.xml new file mode 100644 index 0000000000..bb9f79b040 --- /dev/null +++ b/dom/xslt/crashtests/182460-select.xml @@ -0,0 +1,3 @@ +<?xml version="1.0" encoding="UTF-8" ?>
+<?xml-stylesheet type="text/xsl" href="182460-selects.xsl"?>
+<fud/>
\ No newline at end of file diff --git a/dom/xslt/crashtests/182460-selects.xsl b/dom/xslt/crashtests/182460-selects.xsl new file mode 100644 index 0000000000..f083ea31fe --- /dev/null +++ b/dom/xslt/crashtests/182460-selects.xsl @@ -0,0 +1,5 @@ +<html>
+<body>
+hi
+</body>
+</html>
diff --git a/dom/xslt/crashtests/182460-table.xhtml b/dom/xslt/crashtests/182460-table.xhtml new file mode 100644 index 0000000000..1bf2a23cb4 --- /dev/null +++ b/dom/xslt/crashtests/182460-table.xhtml @@ -0,0 +1,9 @@ +<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title>XSL Crash</title>
+</head>
+<body>
+<iframe src="182460-select.xml"></iframe>
+<script type="text/javascript" src="data:text/javascript,/*no code*/"/>
+</body>
+</html>
diff --git a/dom/xslt/crashtests/226425.xml b/dom/xslt/crashtests/226425.xml new file mode 100644 index 0000000000..c6662cfe2c --- /dev/null +++ b/dom/xslt/crashtests/226425.xml @@ -0,0 +1,4 @@ +<?xml version="1.0" encoding="iso-8859-1"?> +<?xml-stylesheet type="text/xsl" href="226425.xsl" ?> + +<text></text> diff --git a/dom/xslt/crashtests/226425.xsl b/dom/xslt/crashtests/226425.xsl new file mode 100644 index 0000000000..ddb61ae680 --- /dev/null +++ b/dom/xslt/crashtests/226425.xsl @@ -0,0 +1,10 @@ +<?xml version="1.0" encoding="iso-8859-1"?> +<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> +<xsl:output method="html" indent="yes"/> + +<xsl:template match="/"> +<html><body> +<xsl:apply-templates select="document('dontmatter')"/> +</body></html> +</xsl:template> +</xsl:stylesheet> diff --git a/dom/xslt/crashtests/406106-1.html b/dom/xslt/crashtests/406106-1.html new file mode 100644 index 0000000000..86ab510ff8 --- /dev/null +++ b/dom/xslt/crashtests/406106-1.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html> +<head> +<script type="text/javascript"> + +function boom() +{ + var p = new XSLTProcessor(); + p.setParameter("a", "b", {e: p}); +} + +boom(); + +</script> +</head> +<body> +</body> +</html> diff --git a/dom/xslt/crashtests/483444.xml b/dom/xslt/crashtests/483444.xml new file mode 100644 index 0000000000..18fffceba5 --- /dev/null +++ b/dom/xslt/crashtests/483444.xml @@ -0,0 +1,19 @@ +<?xml version="1.0"?> +<?xml-stylesheet type="text/xsl" href="#stylesheet"?> +<!DOCTYPE root [ + <!ATTLIST xsl:stylesheet id ID #IMPLIED> +]> +<root> +<xsl:stylesheet id="stylesheet" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0"> + <xsl:attribute-set name="a"> + <xsl:attribute name="b">c</xsl:attribute> + </xsl:attribute-set> + <xsl:template match="/"> + <b>Please output something!</b> + </xsl:template> + <xsl:attribute-set name="a"> + <xsl:attribute name="b">c</xsl:attribute> + </xsl:attribute-set> +</xsl:stylesheet> +<doc id="foo">this</doc> +</root> diff --git a/dom/xslt/crashtests/485217.xml b/dom/xslt/crashtests/485217.xml new file mode 100644 index 0000000000..93a20e4f77 --- /dev/null +++ b/dom/xslt/crashtests/485217.xml @@ -0,0 +1,8 @@ +<?xml version="1.0" encoding="UTF-8"?> +<?xml-stylesheet type="text/xsl" href="485217.xsl"?> + + +<root xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> + <item1 id="AAAAAAA" /> + <item2 id="AAAAAAAAA" label="AAAAAAAAAAAA"/> +</root> diff --git a/dom/xslt/crashtests/485217.xsl b/dom/xslt/crashtests/485217.xsl new file mode 100644 index 0000000000..2935c5a41b --- /dev/null +++ b/dom/xslt/crashtests/485217.xsl @@ -0,0 +1,18 @@ +<?xml version="1.0" encoding="UTF-8"?> + +<xsl:stylesheet version="2.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> + + <xsl:key name="label" match="item2" use="undeclaredfunc()"/> + + <xsl:template match="root"> + <xsl:for-each select="//item1"> + <xsl:call-template name="item1" /> + </xsl:for-each> + </xsl:template> + + <xsl:template name="item1"> + <xsl:for-each select="key('label', 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA')"> + </xsl:for-each> + </xsl:template> + +</xsl:stylesheet> diff --git a/dom/xslt/crashtests/485286.xml b/dom/xslt/crashtests/485286.xml new file mode 100644 index 0000000000..c87aa940ef --- /dev/null +++ b/dom/xslt/crashtests/485286.xml @@ -0,0 +1,12 @@ +<?xml-stylesheet type="application/xml" href="485286.xml"?> +<transform xmlns="http://www.w3.org/1999/XSL/Transform" version="1.0"> + <variable name="v"> + <for-each select="/"> + <value-of select="count(1)"/> + </for-each> + </variable> + <key name="k" match="/" use="$v"/> + <template match="/"> + <value-of select="key('k', /..)"/> + </template> +</transform> diff --git a/dom/xslt/crashtests/527558_1.xml b/dom/xslt/crashtests/527558_1.xml new file mode 100644 index 0000000000..ebb6c3d533 --- /dev/null +++ b/dom/xslt/crashtests/527558_1.xml @@ -0,0 +1,17 @@ +<?xml version="1.0"?> +<?xml-stylesheet type="text/xml" href="#bug"?> +<!DOCTYPE doc [ +<!ATTLIST xsl:transform + id ID #REQUIRED> +]> +<doc> +<xsl:transform id="bug" + version="2.0" + xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> + <xsl:key name="k0" match="e1" use="key('k0', 'foobar')" /> + <xsl:template id="t1" name="t1" match="key('k0', '1/2/2003')" /> +</xsl:transform> + +<e1 a1="foobar" a2="foobar"/> + +</doc> diff --git a/dom/xslt/crashtests/528300.xml b/dom/xslt/crashtests/528300.xml new file mode 100644 index 0000000000..8902bb373e --- /dev/null +++ b/dom/xslt/crashtests/528300.xml @@ -0,0 +1,22 @@ +<?xml version="1.0"?> +<?xml-stylesheet type="text/xml" href="#bug"?> +<!DOCTYPE doc [ +<!ATTLIST xsl:transform + id ID #REQUIRED> +]> +<doc> +<xsl:transform + xmlns:xsl="http://www.w3.org/1999/XSL/Transform" + version="2.0" + id="bug"> + <xsl:variable name="v0"> + <xsl:for-each select="$v0" /> + </xsl:variable> + <xsl:template name="t2" match="/"> + <xsl:copy-of select="number($v0)" /> + </xsl:template> +</xsl:transform> + +<e1 /> + +</doc> diff --git a/dom/xslt/crashtests/528488.xml b/dom/xslt/crashtests/528488.xml new file mode 100644 index 0000000000..904b345612 --- /dev/null +++ b/dom/xslt/crashtests/528488.xml @@ -0,0 +1,19 @@ +<?xml version="1.0"?> +<?xml-stylesheet type="text/xml" href="#bug"?> +<!DOCTYPE doc [ +<!ATTLIST xsl:transform + id ID #REQUIRED> +]> +<doc> + <xsl:transform + xmlns:xsl="http://www.w3.org/1999/XSL/Transform" + xmlns:exslstrings="http://exslt.org/strings" + version="2.0" + id="bug"> + <xsl:variable name="v0" select="$v0" /> + <xsl:template name="t2" match="/"> + <xsl:param name="p0" select="exslstrings:tokenize('1234','foobar')" /> + <xsl:copy-of select="round($v0)" /> + </xsl:template> + </xsl:transform> +</doc> diff --git a/dom/xslt/crashtests/528963.xml b/dom/xslt/crashtests/528963.xml new file mode 100644 index 0000000000..d855e75634 --- /dev/null +++ b/dom/xslt/crashtests/528963.xml @@ -0,0 +1,22 @@ +<?xml version="1.0"?> +<?xml-stylesheet type="text/xml" href="#bug"?> +<!DOCTYPE doc [ +<!ATTLIST xsl:transform + id ID #REQUIRED> +]> +<doc> + <xsl:transform + xmlns:xsl="http://www.w3.org/1999/XSL/Transform" + version="2.0" + id="bug"> + <xsl:key name="k0" match="e2" use="name('foo')" /> + + <xsl:template name="t1" match="/"> + <xsl:element name="e2" namespace="{//doc}" /> + </xsl:template> + <xsl:template name="t2" match="key('k0', 'bar')" /> + </xsl:transform> + + <e2/> + +</doc> diff --git a/dom/xslt/crashtests/545927.html b/dom/xslt/crashtests/545927.html new file mode 100644 index 0000000000..0a9010e21e --- /dev/null +++ b/dom/xslt/crashtests/545927.html @@ -0,0 +1,28 @@ +<html>
+<head>
+<script>
+function main()
+{
+ xml=document.implementation.createDocument('', '', null);
+ xml.appendChild(doc=xml.createElement('root'));
+
+ var p = new DOMParser();
+ text = '<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">';
+ text += '<xsl:template match="/">';
+ text += '<body>';
+ text += '<xsl:number value="2147483648" format="i"/>';
+ text += '</body>';
+ text += '</xsl:template>';
+ text += '</xsl:stylesheet>';
+ xsl=p.parseFromString(text, 'text/xml');
+
+ xsltProcessor=new XSLTProcessor();
+ xsltProcessor.importStylesheet(xsl);
+ d = xsltProcessor.transformToFragment(xml, document);
+}
+</script>
+</head>
+<body onload="main()">
+</body>
+</html>
+
diff --git a/dom/xslt/crashtests/601543.html b/dom/xslt/crashtests/601543.html new file mode 100644 index 0000000000..af025b242a --- /dev/null +++ b/dom/xslt/crashtests/601543.html @@ -0,0 +1,4 @@ +<!DOCTYPE html> +<script> +(new XSLTProcessor).setParameter('', '', [{}, null]); +</script> diff --git a/dom/xslt/crashtests/602115.html b/dom/xslt/crashtests/602115.html new file mode 100644 index 0000000000..ad42d76a05 --- /dev/null +++ b/dom/xslt/crashtests/602115.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<script> + +try { + var docType = document.implementation.createDocumentType(undefined, '', ''); + var doc = document.implementation.createDocument('', '', null); + var xp = new XSLTProcessor; + xp.importStylesheet(doc); + xp.transformToDocument(docType); +} +catch (ex) {} + +try { + docType = document.implementation.createDocumentType(undefined, '', ''); + doc = document.implementation.createDocument('', '', null); + xp = new XSLTProcessor; + xp.importStylesheet(doc); + xp.transformToFragment(docType, document); +} +catch (ex) {} + +</script> diff --git a/dom/xslt/crashtests/603844.html b/dom/xslt/crashtests/603844.html new file mode 100644 index 0000000000..f576effdb6 --- /dev/null +++ b/dom/xslt/crashtests/603844.html @@ -0,0 +1,32 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<head> +<script> + +function boom() +{ + var frame = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe"); + frame.onload = y; + frame.src = "data:text/plain,0"; + document.body.appendChild(frame); + frameDoc = frame.contentDocument; + + function y() + { + frameDoc.removeChild(frameDoc.documentElement); + + var xp = new XSLTProcessor; + xp.importStylesheet(frameDoc); + try { + xp.transformToDocument(frameDoc.createTextNode('x')); + } catch(e) { } + + document.documentElement.removeAttribute("class"); + } +} + +</script> +</head> + +<body onload="boom();"></body> +</html> diff --git a/dom/xslt/crashtests/667315.xml b/dom/xslt/crashtests/667315.xml new file mode 100644 index 0000000000..7a560ba3bd --- /dev/null +++ b/dom/xslt/crashtests/667315.xml @@ -0,0 +1,11 @@ +<?xml version="1.0"?> +<?xml-stylesheet type="text/xsl" href="#stylesheet"?> +<!DOCTYPE root [ + <!ATTLIST xsl:stylesheet id ID #IMPLIED> +]> +<root> +<xsl:stylesheet id="stylesheet" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0"> + <xsl:variable name="var"><p>a</p></xsl:variable> + <xsl:template match="/"><xsl:copy-of select="$var" /></xsl:template> +</xsl:stylesheet> +</root> diff --git a/dom/xslt/crashtests/91332.xml b/dom/xslt/crashtests/91332.xml new file mode 100644 index 0000000000..c5a463c8a9 --- /dev/null +++ b/dom/xslt/crashtests/91332.xml @@ -0,0 +1,10 @@ +<?xml version="1.0" standalone="yes" ?>
+<?xml-stylesheet type="text/xsl" href="91332.xsl" ?>
+<root>
+ <category name="Rectangles">
+ <list item="square" />
+ </category>
+ <quad id="square">
+ <desc>A square is ...</desc>
+ </quad>
+</root>
diff --git a/dom/xslt/crashtests/91332.xsl b/dom/xslt/crashtests/91332.xsl new file mode 100644 index 0000000000..7d01df22b6 --- /dev/null +++ b/dom/xslt/crashtests/91332.xsl @@ -0,0 +1,21 @@ +<?xml version="1.0" ?>
+<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
+
+ <xsl:key name="polyList" match="quad" use="@id" />
+
+ <xsl:template match="root">
+ <html><body><xsl:apply-templates select="category" /></body></html>
+ </xsl:template>
+
+ <xsl:template match="category">
+ <table><xsl:apply-templates select="list" /></table>
+ </xsl:template>
+
+ <xsl:template match="list">
+ <tr><td><xsl:apply-templates select="key('polyList',@item)" /></td></tr>
+ </xsl:template>
+
+ <xsl:template match="quad">
+ <b>Please output something!</b>
+ </xsl:template>
+</xsl:stylesheet>
diff --git a/dom/xslt/crashtests/949990.html b/dom/xslt/crashtests/949990.html new file mode 100644 index 0000000000..23868e4db3 --- /dev/null +++ b/dom/xslt/crashtests/949990.html @@ -0,0 +1,15 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> + +function boom() { + document.evaluate("a", document.documentElement, null, 4096, null); +} + +</script> +</head> + +<body onload="boom()"></body> +</html> diff --git a/dom/xslt/crashtests/crashtests.list b/dom/xslt/crashtests/crashtests.list new file mode 100644 index 0000000000..711f357862 --- /dev/null +++ b/dom/xslt/crashtests/crashtests.list @@ -0,0 +1,30 @@ +load 91332.xml +load 111994.xml +load 182460-table.xhtml +load 226425.xml +load 406106-1.html +load 483444.xml +load 485217.xml +load 485286.xml +load 527558_1.xml +load 528300.xml +load 528488.xml +load 528963.xml +load 545927.html +load 601543.html +load 602115.html +load 603844.html +load 667315.xml +load 949990.html +load 1089049.html +load 1205163.xml +load 1243337.xml +load 1330492.html +load 1336828.html +load 1336830.html +load 1336832.html +load 1338277.html +load 1361892.html +load 1527277.html +load 1589930.xml +HTTP load 1430818.sjs |