summaryrefslogtreecommitdiffstats
path: root/dom/bindings/crashtests
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-07 19:33:14 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-07 19:33:14 +0000
commit36d22d82aa202bb199967e9512281e9a53db42c9 (patch)
tree105e8c98ddea1c1e4784a60a5a6410fa416be2de /dom/bindings/crashtests
parentInitial commit. (diff)
downloadfirefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.tar.xz
firefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.zip
Adding upstream version 115.7.0esr.upstream/115.7.0esrupstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'dom/bindings/crashtests')
-rw-r--r--dom/bindings/crashtests/1010658-1.html16
-rw-r--r--dom/bindings/crashtests/1010658-2.html16
-rw-r--r--dom/bindings/crashtests/769464.html11
-rw-r--r--dom/bindings/crashtests/822340-1.html11
-rw-r--r--dom/bindings/crashtests/822340-2.html8
-rw-r--r--dom/bindings/crashtests/832899.html5
-rw-r--r--dom/bindings/crashtests/860551.html4
-rw-r--r--dom/bindings/crashtests/860591.html20
-rw-r--r--dom/bindings/crashtests/862092.html19
-rw-r--r--dom/bindings/crashtests/862610.html20
-rw-r--r--dom/bindings/crashtests/869038.html22
-rw-r--r--dom/bindings/crashtests/949940.html16
-rw-r--r--dom/bindings/crashtests/crashtests.list13
-rw-r--r--dom/bindings/crashtests/stringbuffer-USVString.html11
14 files changed, 192 insertions, 0 deletions
diff --git a/dom/bindings/crashtests/1010658-1.html b/dom/bindings/crashtests/1010658-1.html
new file mode 100644
index 0000000000..6b341f4ed9
--- /dev/null
+++ b/dom/bindings/crashtests/1010658-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function boom()
+{
+ window.__proto__ = null;
+ for (var i = 0; i < 10000; ++i) {
+ self.document;
+ }
+}
+
+</script></head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/bindings/crashtests/1010658-2.html b/dom/bindings/crashtests/1010658-2.html
new file mode 100644
index 0000000000..cf473c3dd9
--- /dev/null
+++ b/dom/bindings/crashtests/1010658-2.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function boom()
+{
+ window.__proto__ = function(){};
+ for (var i = 0; i < 10000; ++i) {
+ self.document;
+ }
+}
+
+</script></head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/bindings/crashtests/769464.html b/dom/bindings/crashtests/769464.html
new file mode 100644
index 0000000000..d075ee66a0
--- /dev/null
+++ b/dom/bindings/crashtests/769464.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<script>
+
+function boom()
+{
+ window.getComputedStyle(new Worker("404.js"));
+}
+
+window.addEventListener("load", boom);
+
+</script>
diff --git a/dom/bindings/crashtests/822340-1.html b/dom/bindings/crashtests/822340-1.html
new file mode 100644
index 0000000000..4c8f6ae460
--- /dev/null
+++ b/dom/bindings/crashtests/822340-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<script>
+ var xhr = new XMLHttpRequest;
+ function f() {
+ var x = xhr.getResponseHeader;
+ x("abc");
+ }
+ for (var i = 0; i < 20000; ++i) {
+ try { f(); } catch (e) {}
+ }
+</script>
diff --git a/dom/bindings/crashtests/822340-2.html b/dom/bindings/crashtests/822340-2.html
new file mode 100644
index 0000000000..e938c91aac
--- /dev/null
+++ b/dom/bindings/crashtests/822340-2.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<script>
+ var l = document.getElementsByTagName("*");
+ var count = 20000;
+ for (var i = 0; i < count; ++i) {
+ l.item(0);
+ }
+</script>
diff --git a/dom/bindings/crashtests/832899.html b/dom/bindings/crashtests/832899.html
new file mode 100644
index 0000000000..c565ad00f4
--- /dev/null
+++ b/dom/bindings/crashtests/832899.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<script>
+ var ev = document.createEvent("Events");
+ EventTarget.prototype.dispatchEvent.call(navigator.connection, ev);
+</script>
diff --git a/dom/bindings/crashtests/860551.html b/dom/bindings/crashtests/860551.html
new file mode 100644
index 0000000000..5008e57396
--- /dev/null
+++ b/dom/bindings/crashtests/860551.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+SVGZoomAndPan instanceof SVGZoomAndPan
+</script>
diff --git a/dom/bindings/crashtests/860591.html b/dom/bindings/crashtests/860591.html
new file mode 100644
index 0000000000..565a729c4d
--- /dev/null
+++ b/dom/bindings/crashtests/860591.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+ var timeEvent = document.createEvent('TimeEvent');
+ var mutationEvent = document.createEvent('MutationEvents');
+ mutationEvent.__proto__ = timeEvent;
+ mutationEvent.target;
+
+ var mouseScrollEvent = document.createEvent("MouseScrollEvents");
+ var mouseEvent = document.createEvent("MouseEvents");
+ mouseEvent.__proto__ = mouseScrollEvent;
+ mouseEvent.relatedTarget;
+
+ var uiEvent = document.createEvent("UIEvents");
+ uiEvent.__proto__ = mouseScrollEvent;
+ uiEvent.rangeParent;
+</script>
+</head>
+</html>
diff --git a/dom/bindings/crashtests/862092.html b/dom/bindings/crashtests/862092.html
new file mode 100644
index 0000000000..1b31775a97
--- /dev/null
+++ b/dom/bindings/crashtests/862092.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+ var frameDoc = document.getElementById("f").contentDocument;
+ frameDoc.adoptNode(document.createElement("select"));
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<iframe id="f"></iframe>
+</body>
+</html>
diff --git a/dom/bindings/crashtests/862610.html b/dom/bindings/crashtests/862610.html
new file mode 100644
index 0000000000..768871ad96
--- /dev/null
+++ b/dom/bindings/crashtests/862610.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+ HTMLElement.prototype.__proto__ = new Proxy({}, {});
+ try {
+ window.Image;
+ } finally {
+ // Restore our prototype so the test harnesses can deal with us
+ // We can't just assign to __proto__ because it lives on our proto chain
+ // and we messed that up.
+ var desc = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__");
+ desc.set.call(HTMLElement.prototype, Element.prototype);
+ }
+</script>
+</head>
+
+<body></body>
+</html>
diff --git a/dom/bindings/crashtests/869038.html b/dom/bindings/crashtests/869038.html
new file mode 100644
index 0000000000..dedb4dd4d7
--- /dev/null
+++ b/dom/bindings/crashtests/869038.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+ var frame = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
+ document.body.appendChild(frame);
+ var frameDoc = frame.contentDocument;
+ frameDoc.contentEditable = "true";
+ document.body.removeChild(frame);
+ SpecialPowers.gc();
+ frameDoc.focus();
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/bindings/crashtests/949940.html b/dom/bindings/crashtests/949940.html
new file mode 100644
index 0000000000..7f20085fea
--- /dev/null
+++ b/dom/bindings/crashtests/949940.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+function boom()
+{
+ var frameWin = document.getElementById("f").contentWindow;
+ Object.create(frameWin).self;
+}
+</script>
+</head>
+<body onload="boom()">
+<iframe id="f" src="data:text/html,3"></iframe>
+</body>
+</html>
diff --git a/dom/bindings/crashtests/crashtests.list b/dom/bindings/crashtests/crashtests.list
new file mode 100644
index 0000000000..50126788cd
--- /dev/null
+++ b/dom/bindings/crashtests/crashtests.list
@@ -0,0 +1,13 @@
+skip load 769464.html # bug 823822 - assert often leaks into other tests
+load 822340-1.html
+load 822340-2.html
+load 832899.html
+load 860551.html
+load 860591.html
+load 862092.html
+load 862610.html
+load 869038.html
+load 949940.html
+load 1010658-1.html
+load 1010658-2.html
+load stringbuffer-USVString.html
diff --git a/dom/bindings/crashtests/stringbuffer-USVString.html b/dom/bindings/crashtests/stringbuffer-USVString.html
new file mode 100644
index 0000000000..a193e732b9
--- /dev/null
+++ b/dom/bindings/crashtests/stringbuffer-USVString.html
@@ -0,0 +1,11 @@
+<!doctype html>
+<script>
+ var div = document.createElement("div");
+ // Need a long-enough string that when we get it from the DOM it will not get
+ // inlined and will be an external stringbuffer string.
+ var str = "http://" + (new Array(200).join("a"));
+ div.setAttribute("x", str);
+ str = div.getAttribute("x");
+ // Now pass it as a USVString
+ new URL(str);
+</script>
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-12 13:01:09 +0000