diff options
Diffstat (limited to 'dom/canvas/crashtests')
71 files changed, 1204 insertions, 0 deletions
diff --git a/dom/canvas/crashtests/0px-size-font-667225.html b/dom/canvas/crashtests/0px-size-font-667225.html new file mode 100644 index 0000000000..9de65f8f59 --- /dev/null +++ b/dom/canvas/crashtests/0px-size-font-667225.html @@ -0,0 +1,19 @@ +<html xmlns="http://www.w3.org/1999/xhtml" >
+<script language=javascript>
+
+function draw() {
+ var canv = document.getElementById("canv"); + var ctx = canv.getContext("2d"); + + ctx.fillStyle = "red"; + // 0 size font shouldn't crash! + ctx.font = "0px Arial"; + ctx.fillText("A", 0, 0); + document.documentElement.className = ""; +}
+
+</script>
+<body onload="draw()">
+<canvas id="canv" width="5" height="5"></canvas>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/0px-size-font-shadow.html b/dom/canvas/crashtests/0px-size-font-shadow.html new file mode 100644 index 0000000000..1298f3fa1e --- /dev/null +++ b/dom/canvas/crashtests/0px-size-font-shadow.html @@ -0,0 +1,17 @@ +<!DOCTYPE HTML> +<body> +<canvas id="canv" width="5" height="5"></canvas> +<script> +var canv = document.getElementById("canv"); +var ctx = canv.getContext("2d"); + +ctx.fillStyle = "red"; +// 0 size font shouldn't assert! +ctx.font = "0px Arial"; +ctx.shadowColor = '#f00'; +ctx.shadowBlur = 4; +ctx.fillText("A", 0, 0); +document.documentElement.className = ""; +</script> +</body> +</html> diff --git a/dom/canvas/crashtests/1099143-1.html b/dom/canvas/crashtests/1099143-1.html new file mode 100644 index 0000000000..30bb3a0033 --- /dev/null +++ b/dom/canvas/crashtests/1099143-1.html @@ -0,0 +1,5 @@ +<script> + var canvas = document.createElement("canvas"); + var context = canvas.getContext("2d"); + context.fillText("", 0, 0); +</script> diff --git a/dom/canvas/crashtests/1161277-1.html b/dom/canvas/crashtests/1161277-1.html new file mode 100644 index 0000000000..3e04dc46da --- /dev/null +++ b/dom/canvas/crashtests/1161277-1.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var canvas = document.createElement('canvas'); + var ctx = canvas.getContext('2d'); + ctx.setTransform(0.2988847856952777, 26589683732.25, -562949953421312, 5, 4503599627370495, -2735897607.139075); + ctx.bezierCurveTo(-1023, -4611686018427388000, 4194303, -536870911, 45139.65058316886, 35184372088833); + ctx.setLineDash([1.2307692307692308]); + ctx.setTransform(0, 2097152, 0.0005128205128205128, 305943.4982061649, -49282.263290019946, 3); + ctx.clip("evenodd"); + ctx.scale(-2.3882113703861325, -2); + ctx.isPointInStroke(2, 86124313031369.77); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/canvas/crashtests/1183363.html b/dom/canvas/crashtests/1183363.html new file mode 100644 index 0000000000..2044a80928 --- /dev/null +++ b/dom/canvas/crashtests/1183363.html @@ -0,0 +1,23 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var ctx = canvas.getContext('2d'); + ctx.rect(2, 6, 9, 8); + ctx.setTransform(1, 2, 3, 0, 4, 1); + setTimeout(function() { + ctx.moveTo(0, 1); + ctx.isPointInPath(0, 0, 'evenodd'); + }, 0); +} + +</script> +</head> + +<body onload="boom();"> +<canvas id="canvas"></canvas> +</body> +</html> diff --git a/dom/canvas/crashtests/1190705.html b/dom/canvas/crashtests/1190705.html new file mode 100644 index 0000000000..64795decb6 --- /dev/null +++ b/dom/canvas/crashtests/1190705.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var canvas = document.createElement('canvas'); + var ctx = canvas.getContext('2d'); + ctx.rotate(1e308); + ctx.fillText("A", 1, 1); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/canvas/crashtests/1223740-1.html b/dom/canvas/crashtests/1223740-1.html new file mode 100644 index 0000000000..d5d9696935 --- /dev/null +++ b/dom/canvas/crashtests/1223740-1.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> + +function boom() { + var canvas = document.createElement('canvas'); + var ctx = canvas.getContext('2d'); + ctx.shadowColor = "green"; + ctx.rotate(0.9923); + ctx.transform(6, 0.13807760834183488, 256, -0.39007851257689263, 0.5767177072299453, 64); + ctx.transform(0.61, 0.08697788582345888, 6, 6, 64, 128); + ctx.scale(0.36690500480283633, 6); + ctx.shadowOffsetY = -1.7976931348623157e+308; + ctx.fillText("A",32,0.848476537933684); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/canvas/crashtests/1225381-1.html b/dom/canvas/crashtests/1225381-1.html new file mode 100644 index 0000000000..5d76be9fae --- /dev/null +++ b/dom/canvas/crashtests/1225381-1.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> + +function boom() { + var canvas = document.createElement('canvas'); + var ctx = canvas.getContext('2d'); + ctx.setTransform(new DOMMatrix([32, -1, 0.8320478957221024, 1.7976931348623157e+308, 512, 0.9012573524148337]).invertSelf()); + ctx.fillText("A", 0 ,0); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/canvas/crashtests/1229932-1.html b/dom/canvas/crashtests/1229932-1.html new file mode 100644 index 0000000000..b5f06ff85c --- /dev/null +++ b/dom/canvas/crashtests/1229932-1.html @@ -0,0 +1,16 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> + +function boom() { + var canvas = document.createElement('canvas'); + var ctx = canvas.getContext('2d'); + ctx.fillText("A", 0, 1e308); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/canvas/crashtests/1229983-1.html b/dom/canvas/crashtests/1229983-1.html new file mode 100644 index 0000000000..a865c569e4 --- /dev/null +++ b/dom/canvas/crashtests/1229983-1.html @@ -0,0 +1,24 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> + +function boom() { + var canvas = document.createElement('canvas'); + var ctx = canvas.getContext('2d'); + ctx.lineJoin = 'round'; + ctx.transform(18.5, 41.6, 447, 78.2, 85.75, 120.5); + ctx.transform(186.25, 26.142857142857142, 251.5, -562949953421311, 147, 4.625); + ctx.rotate(32); + ctx.arc(33.8, 1, 183, 141.5, 452.5, 0); + ctx.transform(423, 24.75, 78, 12, 180.25, 191.5); + ctx.shadowBlur = 31.5; + ctx.shadowColor = "blue"; + ctx.stroke(); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/canvas/crashtests/1233613.html b/dom/canvas/crashtests/1233613.html new file mode 100644 index 0000000000..d949c3b21c --- /dev/null +++ b/dom/canvas/crashtests/1233613.html @@ -0,0 +1,19 @@ +<!DOCTYPE html> +<iframe style="display:none" srcdoc=" + +<html> +<head> +<script type='text/javascript'> +function boom() { + var gl = canvas.getContext('experimental-webgl'); + video.srcObject = canvas.captureStream(0); +} +</script> +</head> +<body onload='boom();'> + <video id='video' width='256' height='256'></video> + <canvas id='canvas' width='256' height='256'></canvas> +</body> +</html> + +"></iframe> diff --git a/dom/canvas/crashtests/1244850-1.html b/dom/canvas/crashtests/1244850-1.html new file mode 100644 index 0000000000..015baf2c03 --- /dev/null +++ b/dom/canvas/crashtests/1244850-1.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> + +function boom() +{ + var canvas = document.createElement('canvas'); + var ctx = canvas.getContext('2d'); + var svgImage = document.getElementsByTagName("img")[0]; + ctx.drawImage(svgImage, 1e+308, 0); +} + +</script> +</head> +<body onload="boom();"> + +<img src="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' width='100' height='100'><rect width='100' height='100' fill='blue'/></svg>"> + +</body> +</html> diff --git a/dom/canvas/crashtests/1246775-1.html b/dom/canvas/crashtests/1246775-1.html new file mode 100644 index 0000000000..8c4ddabdf8 --- /dev/null +++ b/dom/canvas/crashtests/1246775-1.html @@ -0,0 +1,15 @@ +<html> +<head> +<script> +function boom() +{ + var canvas = document.getElementById("canvas"); + var ctx = SpecialPowers.wrap(canvas.getContext("2d")); + ctx.drawWindow(window, 0, 0, canvas.width, canvas.height, "red"); +} +</script> +</head> +<body onload="boom();"> +<canvas id="canvas" width="10" height="10"></canvas> +</body> +</html> diff --git a/dom/canvas/crashtests/1283113-1.html b/dom/canvas/crashtests/1283113-1.html new file mode 100644 index 0000000000..50234169be --- /dev/null +++ b/dom/canvas/crashtests/1283113-1.html @@ -0,0 +1,25 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var canvas = document.createElement('canvas'); + var ctx = canvas.getContext('2d'); + ctx.transform(1,1,0,0,0,0); + ctx.scale(610.561277214,0.0); + ctx.scale(442.538892637,64.9064087241); + ctx.scale(851.176724189,322.349092655); + ctx.scale(862.937434575,2.88757032711); + ctx.scale(230.933492526,766.024348731); + ctx.scale(968.538114712,4.580); + ctx.transform(1,0,1,0,1,0); + ctx.scale(341.640607159,753.362567174); + ctx.measureText(''); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/canvas/crashtests/1284356-1.html b/dom/canvas/crashtests/1284356-1.html new file mode 100644 index 0000000000..bbdb135b0e --- /dev/null +++ b/dom/canvas/crashtests/1284356-1.html @@ -0,0 +1,9 @@ +<canvas id='i0'></canvas> +<script> +var c=document.getElementById('i0').getContext('2d'); +c.lineWidth=194.622602174; +c.miterLimit=270.273509738; +c.transform(0,0,0,0,0,0); +c.globalCompositeOperation='soft-light'; +c.strokeText('a',200,273,722); +</script>
\ No newline at end of file diff --git a/dom/canvas/crashtests/1284578-1.html b/dom/canvas/crashtests/1284578-1.html new file mode 100644 index 0000000000..ba6e5f9630 --- /dev/null +++ b/dom/canvas/crashtests/1284578-1.html @@ -0,0 +1,8 @@ +<canvas id='i0'></canvas> +<script> +var c=document.getElementById('i0').getContext('2d'); +c.bezierCurveTo(157,351,351,44,946,701); +c.quadraticCurveTo(260,-9007199254740991,945,145); +c.translate(-9007199254740991,239); +c.isPointInPath(988,439); +</script>
\ No newline at end of file diff --git a/dom/canvas/crashtests/1286458-1.html b/dom/canvas/crashtests/1286458-1.html new file mode 100644 index 0000000000..1241a5f0ed --- /dev/null +++ b/dom/canvas/crashtests/1286458-1.html @@ -0,0 +1,20 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var canvas = document.createElement('canvas'); + var ctx = canvas.getContext('2d'); + var path=new Path2D(); + path.bezierCurveTo(436,Number.MIN_VALUE,620,Number.MAX_SAFE_INTEGER,1,83); + ctx.setTransform(1,Number.MAX_SAFE_INTEGER,1,0,1,146.0); + ctx.scale(16777218,55); + ctx.stroke(path); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/canvas/crashtests/1287515-1.html b/dom/canvas/crashtests/1287515-1.html new file mode 100644 index 0000000000..37dc8a2a0a --- /dev/null +++ b/dom/canvas/crashtests/1287515-1.html @@ -0,0 +1,7 @@ +<canvas id='i0'></canvas> +<script> +var c=document.getElementById('i0').getContext('2d'); +c.lineWidth=Number.MAX_SAFE_INTEGER; +c.setLineDash([1]); +c.strokeRect(1,1,0,Number.MIN_SAFE_INTEGER); +</script> diff --git a/dom/canvas/crashtests/1287652-1.html b/dom/canvas/crashtests/1287652-1.html new file mode 100644 index 0000000000..7eaccd58a3 --- /dev/null +++ b/dom/canvas/crashtests/1287652-1.html @@ -0,0 +1,8 @@ +<canvas id='i0'></canvas> +<script> +var c=document.getElementById('i0').getContext('2d'); +var g=c.createLinearGradient(59,9,38.89,-75.51); +c.fillStyle=g; +c.globalAlpha=0.62; +c.fillText('a',0,24,30); +</script> diff --git a/dom/canvas/crashtests/1288872-1.html b/dom/canvas/crashtests/1288872-1.html new file mode 100644 index 0000000000..de57311a55 --- /dev/null +++ b/dom/canvas/crashtests/1288872-1.html @@ -0,0 +1,6 @@ +<canvas id='id0'></canvas> +<script> +var c=document.getElementById('id0').getContext('2d'); +c.transform(1,0,1,0,0,0); +c.fillText('A',0,53); +</script>
\ No newline at end of file diff --git a/dom/canvas/crashtests/1290628-1.html b/dom/canvas/crashtests/1290628-1.html new file mode 100644 index 0000000000..a2502f70af --- /dev/null +++ b/dom/canvas/crashtests/1290628-1.html @@ -0,0 +1,13 @@ +<!DOCTYPE html> +<html> +<body id='test_body'> +<canvas id='i0'></canvas> +<script> +var c=document.getElementById('i0').getContext('2d'); +c.shadowOffsetX=73; +c.scale(5,55); +c.setLineDash([48,81,88,41,32767,8]); +c.shadowColor='hsl(1.0,1%,1%)'; +c.miterLimit=Number.MIN_VALUE; +c.strokeRect(0,58,8589934591,0); +</script>
\ No newline at end of file diff --git a/dom/canvas/crashtests/1296410-1.html b/dom/canvas/crashtests/1296410-1.html new file mode 100644 index 0000000000..a282d4e0fd --- /dev/null +++ b/dom/canvas/crashtests/1296410-1.html @@ -0,0 +1,9 @@ +<canvas id='canv'></canvas> +<script> +var ctx=document.getElementById('canv').getContext('2d'); +ctx.globalAlpha=0.81; +ctx.scale(22,3406781); +ctx.filter='sepia(80%)'; +ctx.font='52px serif'; +ctx.measureText('A'); +</script> diff --git a/dom/canvas/crashtests/1298576-1.html b/dom/canvas/crashtests/1298576-1.html new file mode 100644 index 0000000000..b3936027eb --- /dev/null +++ b/dom/canvas/crashtests/1298576-1.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html> +<head> +<script id="fshader" type="x-shader/x-fragment"> +void main() { + -2147483648 % 0xffffffff; + gl_FragColor = vec4(0.5, 0.5, 1.0, 1.0); +} +</script> +</head> +<body> +<script> +var gl = document.createElement('canvas').getContext('webgl'); +var program = gl.createProgram(); +var fshader = gl.createShader(gl.FRAGMENT_SHADER); +var fshaderSource = document.getElementById("fshader").text; +gl.shaderSource(fshader, fshaderSource); +gl.compileShader(fshader); +</script> +</body> +</html> diff --git a/dom/canvas/crashtests/1299062-1.html b/dom/canvas/crashtests/1299062-1.html new file mode 100644 index 0000000000..2f33b889ad --- /dev/null +++ b/dom/canvas/crashtests/1299062-1.html @@ -0,0 +1,5 @@ +<canvas id='id0' width='35376.4661501'></canvas> +<script> +var ctx=document.getElementById('id0').getContext('2d'); +ctx.getImageData(66,-1,32,87); +</script> diff --git a/dom/canvas/crashtests/1305085-1.html b/dom/canvas/crashtests/1305085-1.html new file mode 100644 index 0000000000..017d10eb1b --- /dev/null +++ b/dom/canvas/crashtests/1305085-1.html @@ -0,0 +1,9 @@ +<!DOCTYPE html> +<html> +<script> +var c = document.createElementNS('http://www.w3.org/1999/xhtml', 'canvas'); +var cx = c.getContext('2d'); +cx.setTransform(1, 2, 2, 4, 0.41577222277777554, 0.89); +cx.fillText("AA",2048,4); +</script> +</html> diff --git a/dom/canvas/crashtests/1305312-1.html b/dom/canvas/crashtests/1305312-1.html new file mode 100644 index 0000000000..3bd0b8c004 --- /dev/null +++ b/dom/canvas/crashtests/1305312-1.html @@ -0,0 +1,5 @@ +<canvas id='cid'></canvas> +<script> +var x=document.getElementById('cid').getContext('2d',{alpha: false}); +x.putImageData(x.createImageData(250,27434.63),Number.MAX_SAFE_INTEGER,23); +</script>
\ No newline at end of file diff --git a/dom/canvas/crashtests/1305850.html b/dom/canvas/crashtests/1305850.html new file mode 100644 index 0000000000..7f79905161 --- /dev/null +++ b/dom/canvas/crashtests/1305850.html @@ -0,0 +1,11 @@ +<!DOCTYPE html> +<html> +<script> +window.onload=function(){ + var gl = document.createElementNS("http://www.w3.org/1999/xhtml", "canvas").getContext("webgl"); + var shader = gl.createShader(gl.FRAGMENT_SHADER); + gl.shaderSource(shader, 'void main(){d[vec4[]()}'); + gl.compileShader(shader); +}; +</script> +</html> diff --git a/dom/canvas/crashtests/1334366-1.html b/dom/canvas/crashtests/1334366-1.html new file mode 100644 index 0000000000..0b7bc65d9d --- /dev/null +++ b/dom/canvas/crashtests/1334366-1.html @@ -0,0 +1,8 @@ +<script> +Logger={}; Logger.JSError=function(e){}; +try { o0 = document.createElement('canvas'); } catch(e) { Logger.JSError(e); } +try { (document.body || document.documentElement).appendChild(o0) } catch(e) { Logger.JSError(e); } +try { o1 = o0.getContext('2d'); } catch(e) { Logger.JSError(e); } +try { o1.translate(1152921504606847000, 0.919677262874245) } catch(e) { Logger.JSError(e); } +try { o1.fillText("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",0.6494016751296356,-16,0.5988693960474034) } catch(e) { Logger.JSError(e); } +</script> diff --git a/dom/canvas/crashtests/1334647-1.html b/dom/canvas/crashtests/1334647-1.html new file mode 100644 index 0000000000..b4510afebb --- /dev/null +++ b/dom/canvas/crashtests/1334647-1.html @@ -0,0 +1,8 @@ +<script> +Logger={}; Logger.JSError=function(e){}; +try { o0 = document.createElement('canvas'); } catch(e) { Logger.JSError(e); } +try { (document.body || document.documentElement).appendChild(o0) } catch(e) { Logger.JSError(e); } +try { o1 = o0.getContext('2d'); } catch(e) { Logger.JSError(e); } +try { o0.width = 311853383.455201; } catch(e) { Logger.JSError(e); } +try { o1.drawImage(o0, -0.906275445340731, 0.3679144809413502, 2, 32) } catch(e) { Logger.JSError(e); } +</script> diff --git a/dom/canvas/crashtests/1348976-1.html b/dom/canvas/crashtests/1348976-1.html new file mode 100644 index 0000000000..655aec1a73 --- /dev/null +++ b/dom/canvas/crashtests/1348976-1.html @@ -0,0 +1,13 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> +function boom(){ + let c = new OffscreenCanvas(0, 0); + c.transferToImageBitmap(); +} +addEventListener("DOMContentLoaded", boom); +</script> +</head> +</html> diff --git a/dom/canvas/crashtests/1349067.html b/dom/canvas/crashtests/1349067.html new file mode 100644 index 0000000000..f8c8e0da1e --- /dev/null +++ b/dom/canvas/crashtests/1349067.html @@ -0,0 +1,10 @@ +<script> +o0 = document.createElement('canvas'); +document.documentElement.appendChild(o0) +o2 = o0.getContext("webgl2", {"premultipliedAlpha":false,"preserveDrawingBuffer":false,"depth":false}) +o12 = document.createElement('canvas'); +(document.body || document.documentElement).appendChild(o12) +o13 = o12.getContext('2d'); +o14 = o13.getImageData(0.4002597041894355, 128, 8, 0.6125768461759614) +o2.readBuffer(1029) +</script> diff --git a/dom/canvas/crashtests/1357092.html b/dom/canvas/crashtests/1357092.html new file mode 100644 index 0000000000..110aa7e86e --- /dev/null +++ b/dom/canvas/crashtests/1357092.html @@ -0,0 +1,10 @@ +<html> + <head> + <script> + o1 = document.createElement("canvas"); + o1.setAttribute("width", "100000"); + o2 = o1.getContext("2d"); + o2.bezierCurveTo(64, 1, 1, 1, 1, 1); + </script> + </head> +</html> diff --git a/dom/canvas/crashtests/1441613.html b/dom/canvas/crashtests/1441613.html new file mode 100644 index 0000000000..c6ca8f3492 --- /dev/null +++ b/dom/canvas/crashtests/1441613.html @@ -0,0 +1,19 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<iframe id="iframe" src="about:blank"></iframe> +<script> +iframe.onload = function() { + let doc = iframe.contentDocument; + let canvas = doc.createElement('canvas'); + doc.body.appendChild(canvas); + let ctx = canvas.getContext('2d'); + document.body.offsetTop; + iframe.style.display = 'none'; + try { + ctx.font = '10px serif'; + } finally { + document.documentElement.className = ""; + } +}; +</script> +</html> diff --git a/dom/canvas/crashtests/1443671.html b/dom/canvas/crashtests/1443671.html new file mode 100644 index 0000000000..28a2fcd0a8 --- /dev/null +++ b/dom/canvas/crashtests/1443671.html @@ -0,0 +1,8 @@ +<!DOCTYPE html> +<html> +<script> +try { o1 = document.createElement('canvas') } catch (e) {} +try { o2 = o1.transferControlToOffscreen() } catch (e) {} +try { o2.getContext("webgl", { }) } catch (e) {} +</script> +</html> diff --git a/dom/canvas/crashtests/1546390.html b/dom/canvas/crashtests/1546390.html new file mode 100644 index 0000000000..b44eb8ea47 --- /dev/null +++ b/dom/canvas/crashtests/1546390.html @@ -0,0 +1,11 @@ +<html> +<head> + <script> + function start () { + new OffscreenCanvas(1, 127).toBlob() + } + + window.addEventListener('load', start) + </script> +</head> +</html> diff --git a/dom/canvas/crashtests/1549853.html b/dom/canvas/crashtests/1549853.html new file mode 100644 index 0000000000..532430e386 --- /dev/null +++ b/dom/canvas/crashtests/1549853.html @@ -0,0 +1,8 @@ +<canvas id='a' height='67108864' width='80'></canvas> +<script> +document.addEventListener("DOMContentLoaded", function() { + var c=document.getElementById('a') + var x=c.getContext('2d', {alpha: true}) + c.setAttribute('width', 800) +}) +</script> diff --git a/dom/canvas/crashtests/1551745.html b/dom/canvas/crashtests/1551745.html new file mode 100644 index 0000000000..f7617b96ef --- /dev/null +++ b/dom/canvas/crashtests/1551745.html @@ -0,0 +1,9 @@ +<script> +window.addEventListener('load', function() { + b.getContext('2d') + a.src = b.toDataURL('image/jpeg', 0.1) + b.setAttribute('width', 2684354) +}) +</script> +<img id='a' src='data:image/gif;base64,R0lGODlhAQABAIABAP///wAAACwAAAAAAQABAAACAkQBADs='/> +<canvas id='b' height='800' width='800'></canvas> diff --git a/dom/canvas/crashtests/1569648.html b/dom/canvas/crashtests/1569648.html new file mode 100644 index 0000000000..766d9fa937 --- /dev/null +++ b/dom/canvas/crashtests/1569648.html @@ -0,0 +1,5 @@ +<!doctype html> +<base href="a:"> +<script> + document.createElement("canvas").getContext("2d").filter = "url()"; +</script> diff --git a/dom/canvas/crashtests/1654477.html b/dom/canvas/crashtests/1654477.html new file mode 100644 index 0000000000..5303291fe2 --- /dev/null +++ b/dom/canvas/crashtests/1654477.html @@ -0,0 +1,26 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + const canvas = document.getElementById('canvas'); + const ctx = canvas.getContext('2d'); + + for (let i = 0; i < 50; i++) { + canvas.width = 20; + ctx.fillStyle = 'green'; + ctx.fillRect(1, 1, 20, 20); + canvas.width = 10; + ctx.fillStyle = 'green'; + ctx.fillRect(1, 1, 10, 10); + } +} + +</script> +</head> +<body onload="boom();"> +<canvas id="canvas"></canvas> +</body> +</html> diff --git a/dom/canvas/crashtests/1739454-1.html b/dom/canvas/crashtests/1739454-1.html new file mode 100644 index 0000000000..a32445249d --- /dev/null +++ b/dom/canvas/crashtests/1739454-1.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<script> +document.addEventListener('DOMContentLoaded', async () => { + cnv = document.createElement('canvas') + ctx = cnv.getContext('2d') + try { + a = await fetch(''); + b = await a.arrayBuffer(); + c = await self.createImageBitmap(new Blob([b]), {'premultiplyAlpha':'none'}) + ctx.createPattern(c, 'repeat-x') + } finally { + document.documentElement.className = ""; + } +}) +</script> +</html> diff --git a/dom/canvas/crashtests/1740031.html b/dom/canvas/crashtests/1740031.html new file mode 100644 index 0000000000..fb5d11b3fd --- /dev/null +++ b/dom/canvas/crashtests/1740031.html @@ -0,0 +1,12 @@ +<!DOCTYPE html> +<html> +<head> + <script> + document.addEventListener('DOMContentLoaded', () => { + const canvas = document.createElementNS('http://www.w3.org/1999/xhtml', 'canvas') + const context = canvas.getContext('webgl') + window.createImageBitmap(canvas, 81, 253, 1754696613, 348508165) + }) + </script> +</head> +</html> diff --git a/dom/canvas/crashtests/1744172.html b/dom/canvas/crashtests/1744172.html new file mode 100644 index 0000000000..0fd6313bba --- /dev/null +++ b/dom/canvas/crashtests/1744172.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="utf-8"> +<script> + +document.addEventListener('DOMContentLoaded', () => { + const gl = document.createElement('canvas').getContext('webgl'); + const a = gl.getExtension('EXT_disjoint_timer_query'); + const b = a.createQueryEXT(); + a.queryCounterEXT(b, a.TIMESTAMP_EXT); + a.deleteQueryEXT(b); +}); + +</script> +</head> +</html> diff --git a/dom/canvas/crashtests/1757755.html b/dom/canvas/crashtests/1757755.html new file mode 100644 index 0000000000..4e222f79cd --- /dev/null +++ b/dom/canvas/crashtests/1757755.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="utf-8"> +<script> + +window.addEventListener("load", () => { + const canvas = document.createElement('canvas'); + const context = canvas.getContext("webgl"); + const extension = context.getExtension("WEBGL_lose_context"); + extension.loseContext(); + extension.restoreContext(); + canvas.height = 0; +}); + +</script> +</head> +</html> diff --git a/dom/canvas/crashtests/1757925-1.html b/dom/canvas/crashtests/1757925-1.html new file mode 100644 index 0000000000..c42ab9c876 --- /dev/null +++ b/dom/canvas/crashtests/1757925-1.html @@ -0,0 +1,15 @@ +<!DOCTYPE html> +<html> +<head> +<script> + window.addEventListener("load", () => { + const canvas = document.createElement("canvas") + const context = canvas.getContext("2d") + context.shadowColor = "#cad1" + context.setTransform({ "b": 2.144923254600512e+37 }) + context.shadowOffsetY = -128 + context.drawImage(canvas, 16, 255, 128, -128) + }) + </script> +</head> +</html>
\ No newline at end of file diff --git a/dom/canvas/crashtests/1769878.html b/dom/canvas/crashtests/1769878.html new file mode 100644 index 0000000000..1646f71793 --- /dev/null +++ b/dom/canvas/crashtests/1769878.html @@ -0,0 +1,15 @@ +<!DOCTYPE html> +<script id="w1"> + self.onmessage = async () => { + try { self.close() } catch (e) {} + let a = new OffscreenCanvas(143, 178) + a.convertToBlob({ }) + } + </script> +<script> + window.addEventListener('load', async () => { + const blob = new Blob([document.querySelector('#w1').textContent], { type: "text/javascript" }) + const worker = new Worker(window.URL.createObjectURL(blob)) + worker.postMessage([], []) + }) +</script> diff --git a/dom/canvas/crashtests/1771007-1.html b/dom/canvas/crashtests/1771007-1.html new file mode 100644 index 0000000000..1e5642e3ad --- /dev/null +++ b/dom/canvas/crashtests/1771007-1.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html> +<head> + <script id="worker1" type="javascript/worker"> + self.onmessage = async function (e) { + const canvas = new OffscreenCanvas(82, 127) + canvas.getContext('2d', {}) + canvas.width = 134 + await canvas.convertToBlob({}) + canvas.transferToImageBitmap() + } + </script> + <script> + window.addEventListener('load', () => { + const blob = new Blob([document.querySelector('#worker1').textContent], { type: 'text/javascript' }) + const worker = new Worker(window.URL.createObjectURL(blob)) + worker.postMessage([], []) + setTimeout('self.close()', 500) + }) + </script> +</head> +</html>
\ No newline at end of file diff --git a/dom/canvas/crashtests/1816140.html b/dom/canvas/crashtests/1816140.html new file mode 100644 index 0000000000..3fe55cef62 --- /dev/null +++ b/dom/canvas/crashtests/1816140.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html> +<head> + <script> + window.addEventListener("load", async () => { + const adapter = await navigator.gpu.requestAdapter({}) + const device = await adapter.requestDevice({}) + const canvas = new OffscreenCanvas(184, 4266759736) + context = canvas.getContext('webgpu') + context.configure({ + device: device, + format: context.getPreferredFormat(adapter), + }) + }) + </script> +</head> +</html>
\ No newline at end of file diff --git a/dom/canvas/crashtests/360293-1.html b/dom/canvas/crashtests/360293-1.html new file mode 100644 index 0000000000..8a0859e41b --- /dev/null +++ b/dom/canvas/crashtests/360293-1.html @@ -0,0 +1,35 @@ +<html> + + +<body> + Firefox: <a href="javascript:noCrash()">no crash</a> | <a href="javascript:crash()">crash</a><br/> + <canvas id="foo" width="200" height="200"> + </canvas> + <script> + function d(lineWidth){ + var c = document.getElementById("foo").getContext("2d") + c.clearRect(0,0,200,200) + c.lineWidth = lineWidth + c.beginPath() + c.arc(100,100,80, Math.PI, 2*Math.PI, 1) + c.stroke() + c.beginPath() + c.arc(50,50, 20, 0, 2*Math.PI, 1) + c.stroke() + c.beginPath() + c.arc(150,50, 20, 0, 2*Math.PI, 1) + c.stroke() + } + function noCrash() { + d(Math.random()*20+5) + } + function crash() { + d( '_' ) + } + + crash(); + </script> + +</body> + +</html> diff --git a/dom/canvas/crashtests/421715-1.html b/dom/canvas/crashtests/421715-1.html new file mode 100644 index 0000000000..c2ea9b28ad --- /dev/null +++ b/dom/canvas/crashtests/421715-1.html @@ -0,0 +1,41 @@ +<!DOCTYPE html> +<html> + <head> + <script type="text/javascript"> + function stringify(a) { + if (a) + return a.toSource(); + return ''+a; + } + var args = [undefined, null, [], {}, 0, "0"]; + var stringArgs = args.map(stringify); + + function test_method(context, method, arity) { + function testParams(existingParams, depth) { + for (var arg of stringArgs) { + var code = "context[method](" + existingParams + arg + ")"; + try { + eval(code); + } catch (ex) { + // Exceptions are expected + } + + if (depth < arity) + testParams(existingParams + arg + ",", depth + 1); + } + } + testParams("", 1); + } + + function startTest() { + var canvas = document.getElementById("img"); + var context = canvas.getContext('2d');; + test_method(context, "getImageData", 4); + test_method(context, "putImageData", 3); + } + </script> + </head> + <body onload="startTest()"> + <canvas id="img">No canvas support.</canvas> + </body> +</html> diff --git a/dom/canvas/crashtests/553938-1.html b/dom/canvas/crashtests/553938-1.html new file mode 100644 index 0000000000..97e6b6c8ab --- /dev/null +++ b/dom/canvas/crashtests/553938-1.html @@ -0,0 +1,20 @@ +<!doctype html> +<html> + <head> + <meta http-equiv="content-type" content="text/html; charset=UTF-8"> + <title>ImageData Crash Test</title> + </head> + <body onload="crash();"> + <canvas id="c" width="10" height="10"></canvas> + <script> + function crash() { + var canvas = document.getElementById('c'); + var ctx = canvas.getContext('2d'); + var imgData = {data: new Array(10*10*4), width: 10, height: 10}; + + imgData[0] = 0; + ctx.putImageData(imgData, 0, 0); + } + </script> + </body> +</html> diff --git a/dom/canvas/crashtests/647480.html b/dom/canvas/crashtests/647480.html new file mode 100644 index 0000000000..2693207b15 --- /dev/null +++ b/dom/canvas/crashtests/647480.html @@ -0,0 +1,102 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var canvas = document.createElementNS("http://www.w3.org/1999/xhtml", "canvas"); + var ctx = canvas.getContext("2d"); + document.implementation.createDocument("", "", null).adoptNode(canvas); + + try { ctx.save(); } catch(e){} + try { ctx.restore(); } catch(e){} + try { ctx.scale(0,0); } catch(e){} + try { ctx.rotate(90); } catch(e){} + try { ctx.translate(1,1); } catch(e){} + try { ctx.transform(0,100,200,300,10,10); } catch(e){} + try { ctx.setTransform(0,100,200,300,10,10); } catch(e){} + + try { x = ctx.globalAlpha; } catch(e){} + try { ctx.globalAlpha = 0.8; } catch(e){} + try { x = ctx.globalCompositeOperation; } catch(e){} + try { ctx.globalCompositeOperation = "copy"; } catch(e){} + try { x = ctx.strokeStyle; } catch(e){} + try { ctx.strokeStyle = "red"; } catch(e){} + try { x = ctx.fillStyle; } catch(e){} + try { ctx.fillStyle = "red"; } catch(e){} + + try { ctx.createLinearGradient(0,100,100,100); } catch(e){} + try { ctx.createRadialGradient(0,100,100,100,10,10); } catch(e){} + try { ctx.createPattern(document.getElementsByTagName('img')[0], "repeat"); } catch(e){} + + try { x = ctx.lineWidth; } catch(e){} + try { ctx.lineWidth = 2; } catch(e){} + try { x = ctx.lineCap; } catch(e){} + try { ctx.lineCap = "round"; } catch(e){} + try { x = ctx.lineJoin; } catch(e){} + try { ctx.lineJoin = "bevel"; } catch(e){} + try { x = ctx.miterLimit; } catch(e){} + try { ctx.miterLimit = 12; } catch(e){} + + try { x = ctx.shadowOffsetX; } catch(e){} + try { ctx.shadowOffsetX = 1; } catch(e){} + try { x = ctx.shadowOffsetY; } catch(e){} + try { ctx.shadowOffsetY = 1; } catch(e){} + try { x = ctx.shadowBlur; } catch(e){} + try { ctx.shadowBlur = 1; } catch(e){} + try { x = ctx.shadowColor; } catch(e){} + try { ctx.shadowColor = "red"; } catch(e){} + + try { ctx.clearRect(0,0,100,100); } catch(e){} + try { ctx.fillRect(0,0,100,100); } catch(e){} + try { ctx.strokeRect(0,0,100,100); } catch(e){} + + try { ctx.beginPath(); } catch(e){} + try { ctx.moveTo(1,1); } catch(e){} + try { ctx.lineTo(10,10); } catch(e){} + try { ctx.quadraticCurveTo(1,2,3,4); } catch(e){} + try { ctx.bezierCurveTo(1,2,3,4,5,6); } catch(e){} + try { ctx.arcTo(1,2,3,4,5); } catch(e){} + try { ctx.arc(1,2,3,4,5); } catch(e){} + try { ctx.arc(1,2,3,4,5,true); } catch(e){} + try { ctx.rect(1,2,3,4); } catch(e){} + try { ctx.closePath(); } catch(e){} + + try { ctx.fill(); } catch(e){} + try { ctx.stroke(); } catch(e){} + try { ctx.clip(); } catch(e){} + + try { x = ctx.font; } catch(e){} + try { ctx.font = "14px sans-serif"; } catch(e){} + try { x = ctx.textAlign; } catch(e){} + try { ctx.textAlign = "right"; } catch(e){} + try { x = ctx.textBaseline; } catch(e){} + try { ctx.textBaseline = "top"; } catch(e){} + + try { ctx.fillText("",0,0); } catch(e){} + try { ctx.strokeText("",0,0); } catch(e){} + try { ctx.measureText(""); } catch(e){} + + try { ctx.mozDrawText(""); } catch(e){} + try { ctx.mozPathText(""); } catch(e){} + try { ctx.mozTextAlongPath("",true); } catch(e){} + try { ctx.mozTextAlongPath("",false); } catch(e){} + + try { ctx.drawImage(document.getElementsByTagName('img')[0], 0, 0); } catch(e){} + try { ctx.isPointInPath(0, 0); } catch(e){} + try { ctx.createImageData(); } catch(e){} + try { ctx.getImageData(); } catch(e){} + try { ctx.putImageData(); } catch(e){} + + try { x = ctx.imageSmoothingEnabled; } catch(e){} + try { ctx.imageSmoothingEnabled = false; } catch(e){} + try { ctx.imageSmoothingEnabled = true; } catch(e){} + + try { ctx.drawWindow(window, 0, 0, 0, 0, "red"); } catch(e){} +} + +</script> +</head> +<body onload="boom();"><img width="100" height="100" src="data:image/gif;base64,R0lGODlhAQABAIABAAD/AP///ywAAAAAAQABAAACAkQBADs="></body> +</html> diff --git a/dom/canvas/crashtests/727547.html b/dom/canvas/crashtests/727547.html new file mode 100644 index 0000000000..005841de8a --- /dev/null +++ b/dom/canvas/crashtests/727547.html @@ -0,0 +1,7 @@ +<!doctype html> +<canvas></canvas> +<script> +var canvas = document.body.firstChild, + gl = canvas.getContext("experimental-webgl"); +gl.texImage2D(0, 0, 0, 0, 0, { width: 10, height: 10, data: 7 }); +</script> diff --git a/dom/canvas/crashtests/729116.html b/dom/canvas/crashtests/729116.html new file mode 100644 index 0000000000..679f9d2965 --- /dev/null +++ b/dom/canvas/crashtests/729116.html @@ -0,0 +1,18 @@ +<html>
+<script language=javascript>
+
+function draw() {
+ var canv = document.getElementById("canv"); + var ctx = canv.getContext("2d");
+ try {
+ canv.width = 50000;
+ } catch (e) { }
+
+ ctx.clearRect(0, 0, 10, 10); +}
+
+</script>
+<body onload="draw()">
+<canvas id="canv" width="5" height="5"></canvas>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/743499-negative-size.html b/dom/canvas/crashtests/743499-negative-size.html new file mode 100644 index 0000000000..7cfcd55b2a --- /dev/null +++ b/dom/canvas/crashtests/743499-negative-size.html @@ -0,0 +1,22 @@ +<html> +<head> + <title></title> + <script type="text/javascript"> + function go() { + var canvas = document.createElement("canvas"); + var ctx = canvas.getContext('2d'); + ctx.globalAlpha = 4 + ctx.lineCap = "foo" + ctx.strokeRect(256,1024,8,4) + ctx.shadowColor = "black" + ctx.shadowOffsetY = 64 + ctx.stroke() + ctx.moveTo(32,1024) + ctx.closePath() + } + </script> +</head> +<body onload="go()"> +<canvas id="canvas"></canvas> +</body> +</html>
\ No newline at end of file diff --git a/dom/canvas/crashtests/745699-1.html b/dom/canvas/crashtests/745699-1.html new file mode 100644 index 0000000000..c65acf201a --- /dev/null +++ b/dom/canvas/crashtests/745699-1.html @@ -0,0 +1,25 @@ +<!DOCTYPE html> +<html> +<head> +<style> +@font-face { + font-family: "z"; + src: url(invalid); +} +</style> + +<script> +function boom() +{ + var ctx = document.querySelector("canvas").getContext('2d'); + ctx.font = "10px serif"; + document.querySelector("style").appendChild(document.createTextNode(" ")); + ctx.measureText("123"); +} +</script> +</head> + +<body onload="boom();"> +<canvas width="100" height="100"></canvas> +</body> +</html> diff --git a/dom/canvas/crashtests/745818-large-source.html b/dom/canvas/crashtests/745818-large-source.html new file mode 100644 index 0000000000..a5be76be06 --- /dev/null +++ b/dom/canvas/crashtests/745818-large-source.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var a = document.getElementById("a"); + var b = document.getElementById("b"); + a.getContext('2d').createPattern(b, 'no-repeat'); +} + +</script> +</head> + +<body onload="boom();"> +<canvas id="a" width="61" height="26"></canvas> +<canvas id="b" width="611" height="439807"></canvas> +</body> + +</html> diff --git a/dom/canvas/crashtests/746813-1.html b/dom/canvas/crashtests/746813-1.html new file mode 100644 index 0000000000..0e22e7f9d8 --- /dev/null +++ b/dom/canvas/crashtests/746813-1.html @@ -0,0 +1,6 @@ +<!DOCTYPE html> +<html> +<body onload="document.getElementById('c').getContext('2d').getTransform().invertSelf();"> +<canvas id="c" width="772" height="76441"></canvas> +</body> +</html> diff --git a/dom/canvas/crashtests/767337-1.html b/dom/canvas/crashtests/767337-1.html new file mode 100644 index 0000000000..3c2c4ebd18 --- /dev/null +++ b/dom/canvas/crashtests/767337-1.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html> +<body> +<canvas id="c" width="500" height="1000"> +</canvas> +<script> +var ctxt = document.getElementById('c').getContext('2d'); +for (var k = 0; k < 100; ++j) { + for (var j = 0; j < 10; ++j) { + for (var i = 0; i < 1000; ++i) { + gradient = ctxt.createLinearGradient(0,0,200,i); + gradient.addColorStop(0,'black'); + gradient.addColorStop(1,'rgba(0, 255*k/100, 0, 0.1)'); + ctxt.fillStyle = gradient; + ctxt.fillRect(j*50, 2*i, 50, 2); + } + } +} +</script> +</body> +</html>
\ No newline at end of file diff --git a/dom/canvas/crashtests/779426.html b/dom/canvas/crashtests/779426.html new file mode 100644 index 0000000000..ded3455b81 --- /dev/null +++ b/dom/canvas/crashtests/779426.html @@ -0,0 +1,19 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var canvas = document.createElementNS('http://www.w3.org/1999/xhtml', 'canvas'); + var canvas2d = canvas.getContext('2d'); + canvas2d.rect(0, 0, 1, 1); + canvas2d.transform(1, 0, 0, 1, 0, 0); + canvas.setAttributeNS(null, "height", "99"); + canvas2d.rect(0, 0, 1, 1); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/canvas/crashtests/780392-1.html b/dom/canvas/crashtests/780392-1.html new file mode 100644 index 0000000000..2112c9a759 --- /dev/null +++ b/dom/canvas/crashtests/780392-1.html @@ -0,0 +1,10 @@ +<!doctype HTML> +<html> +<body> +<canvas id="c" width="10000" height="10000"></canvas> +<script> +var ctx = document.getElementById("c").getContext("2d"); +ctx.fillText("Hello world!", 50, 50); +</script> +</body> +</html> diff --git a/dom/canvas/crashtests/789933-1.html b/dom/canvas/crashtests/789933-1.html new file mode 100644 index 0000000000..a5f2f3437b --- /dev/null +++ b/dom/canvas/crashtests/789933-1.html @@ -0,0 +1,13 @@ +<!DOCTYPE html> +<html> +<body> +<canvas id="c" width="5000" height="20000"> +</canvas> +<script> +var ctxt = document.getElementById('c').getContext('2d'); +ctxt.strokeStyle = "Red"; +ctxt.font = "bold 16px Arial"; +ctxt.strokeText('Hello World!', 100, 100); +</script> +</body> +</html> diff --git a/dom/canvas/crashtests/794463-1.html b/dom/canvas/crashtests/794463-1.html new file mode 100644 index 0000000000..5726baa743 --- /dev/null +++ b/dom/canvas/crashtests/794463-1.html @@ -0,0 +1,17 @@ +<!-- Any copyright is dedicated to the Public Domain. + - http://creativecommons.org/publicdomain/zero/1.0/ --> + +<!doctype HTML> +<html> +<body> +<canvas id="c" width="100" height="100"></canvas> +<script> +var c = document.getElementById("c"); +var ctx = c.getContext("2d"); +var p = ctx.createPattern(c, "no-repeat"); +ctx.rect(0, 0, 100, 100); +ctx.fillStyle = p; +ctx.fill(); +</script> +</body> +</html> diff --git a/dom/canvas/crashtests/802926-1.html b/dom/canvas/crashtests/802926-1.html new file mode 100644 index 0000000000..a42ca50c1b --- /dev/null +++ b/dom/canvas/crashtests/802926-1.html @@ -0,0 +1,6 @@ +<!DOCTYPE html> +<script> + +document.createElement('canvas').toBlob(null); + +</script> diff --git a/dom/canvas/crashtests/844280.html b/dom/canvas/crashtests/844280.html new file mode 100644 index 0000000000..5d1e2dceab --- /dev/null +++ b/dom/canvas/crashtests/844280.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var canvas = document.createElement("canvas"); + canvas.setAttribute("width", "7623"); + canvas.setAttribute("height", "14064"); + canvas.getContext("experimental-webgl"); +} + +</script> +</head> + +<body onload="boom();"></body> +</html> diff --git a/dom/canvas/crashtests/896047-1.html b/dom/canvas/crashtests/896047-1.html new file mode 100644 index 0000000000..2b121b2279 --- /dev/null +++ b/dom/canvas/crashtests/896047-1.html @@ -0,0 +1,17 @@ +<!DOCTYPE html>
+<html>
+<body>
+<canvas id="c" width="200" height="100">
+</canvas>
+<script>
+var ctx = document.getElementById("c").getContext("2d");
+ctx.save();
+ctx.save();
+ctx.rect(0,0, 1,1);
+ctx.restore();
+ctx.fill('evenodd');
+ctx.restore();
+ctx.lineTo(10, 0);
+</script>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/896047-2.html b/dom/canvas/crashtests/896047-2.html new file mode 100644 index 0000000000..4cd12dfb48 --- /dev/null +++ b/dom/canvas/crashtests/896047-2.html @@ -0,0 +1,19 @@ +<!DOCTYPE html>
+<html>
+<body>
+<canvas id="c" width="200" height="100">
+</canvas>
+<script>
+var ctx = document.getElementById("c").getContext("2d");
+ctx.save();
+ctx.mozFillRule = 'nonzero';
+ctx.save();
+ctx.mozFillRule = 'evenodd';
+ctx.rect(0,0, 1,1);
+ctx.restore();
+ctx.isPointInPath(0,0);
+ctx.restore();
+ctx.lineTo(10, 0);
+</script>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/916128-1.html b/dom/canvas/crashtests/916128-1.html new file mode 100644 index 0000000000..7981271e9c --- /dev/null +++ b/dom/canvas/crashtests/916128-1.html @@ -0,0 +1,13 @@ +<script> +o0 = document.createElement('canvas'); +(document.body || document.documentElement).appendChild(o0); +o1 = o0.getContext('2d'); +o2 = document.createElement('img'); +//o2.src = "image2.png"; +o3 = o1.createImageData(0.7409945472006207, 0.8815588599260801); +o1.save(); +o1.setTransform(0.18777365986904448, 4, 4, -2048, 3, 32); +o0.width = 0.52; +o1.putImageData(o3, -32, -0.16596290333335356); +o0.toBlob(function() {}, "video/mp4", 16); +</script> diff --git a/dom/canvas/crashtests/934939-1.html b/dom/canvas/crashtests/934939-1.html new file mode 100644 index 0000000000..d2ffbf4755 --- /dev/null +++ b/dom/canvas/crashtests/934939-1.html @@ -0,0 +1,8 @@ +<script type="text/javascript"> + function run() { + var cx = canvas.getContext("2d"); + canvas.toDataURL("image/png"); + } +</script> +<body onload="run()"> +<canvas width="1" height="65536" id="canvas"></canvas> diff --git a/dom/canvas/crashtests/989628.html b/dom/canvas/crashtests/989628.html new file mode 100644 index 0000000000..99735a947a --- /dev/null +++ b/dom/canvas/crashtests/989628.html @@ -0,0 +1,9 @@ +<script> +o0 = document.createElement('canvas'); +o1 = o0.getContext('2d'); +o3 = o1.createImageData(32, 0.696); +o1.arc(128, 0.37, 256, 4, 0.070, true); +o1.moveTo(-2, 0.973); +o1.clip('evenodd'); +o1.strokeText("A",0.610,-0.335,0.817); +</script> diff --git a/dom/canvas/crashtests/crashtests.list b/dom/canvas/crashtests/crashtests.list new file mode 100644 index 0000000000..fb15a8d73d --- /dev/null +++ b/dom/canvas/crashtests/crashtests.list @@ -0,0 +1,67 @@ +load 0px-size-font-667225.html +load 0px-size-font-shadow.html +load 360293-1.html +load 421715-1.html +load 553938-1.html +load 647480.html +skip-if(Android&&browserIsRemote) load 727547.html # bug 1507207 +load 729116.html +load 745699-1.html +load 746813-1.html +load 743499-negative-size.html +load 745818-large-source.html +load 767337-1.html +load 779426.html +skip-if(ThreadSanitizer) load 780392-1.html +skip-if(ThreadSanitizer) skip-if(gtkWidget&&isDebugBuild) skip-if(winWidget&&(!is64Bit)) load 789933-1.html # bug 1155252 for linux +skip-if(ThreadSanitizer) load 794463-1.html +skip-if(ThreadSanitizer) load 802926-1.html +skip-if(ThreadSanitizer) skip-if(winWidget&&isDebugBuild&&/^Windows\x20NT\x206\.1/.test(http.oscpu)) load 844280.html # intermittent OOMs on Win7 debug +load 896047-1.html +load 916128-1.html +load 934939-1.html +load 989628.html +load 1099143-1.html +load 1161277-1.html +load 1183363.html +load 1190705.html +load 1223740-1.html +load 1225381-1.html +skip-if(azureCairo) load 1229983-1.html +load 1229932-1.html +load 1244850-1.html +load 1246775-1.html +load 1284356-1.html +load 1284578-1.html +skip-if(d2d) load 1287515-1.html +load 1287652-1.html +load 1288872-1.html +load 1290628-1.html +load 1283113-1.html +load 1286458-1.html +load 1296410-1.html +load 1298576-1.html +load 1299062-1.html +load 1305085-1.html +load 1305312-1.html +load 1305850.html +load 1334366-1.html +load 1334647-1.html +skip-if(geckoview) load 1349067.html # Bug 1563214 for GV+WR +skip-if(ThreadSanitizer) pref(gfx.offscreencanvas.enabled,true) load 1348976-1.html +load 1357092.html +load 1441613.html +pref(gfx.offscreencanvas.enabled,true) load 1443671.html +pref(gfx.offscreencanvas.enabled,true) load 1546390.html +load 1549853.html +load 1551745.html +load 1569648.html +skip-if(!winWidget||!isDebugBuild) pref(layers.gpu-process.crash-also-crashes-browser,true) load 1654477.html +load 1739454-1.html +load 1740031.html +pref(webgl.enable-privileged-extensions,true) load 1744172.html +load 1757925-1.html +load 1757755.html +pref(gfx.offscreencanvas.enabled,true) load 1769878.html +pref(gfx.offscreencanvas.enabled,true) load 1771007-1.html +pref(dom.webgpu.enabled,true) load 1816140.html diff --git a/dom/canvas/crashtests/texImage2D.html b/dom/canvas/crashtests/texImage2D.html new file mode 100644 index 0000000000..370b008572 --- /dev/null +++ b/dom/canvas/crashtests/texImage2D.html @@ -0,0 +1,8 @@ +<!doctype html> +<canvas></canvas> +<script> +var canvas = document.body.firstChild, + gl = canvas.getContext("experimental-webgl"); +gl.texImage2D(0, 0, 0, 0, 0, { get width() { throw 7 }, get height() { throw 7 }, data: new Uint8ClampedArray(10) }); +gl.texSubImage2D(0, 0, 0, 0, 0, 0, { get width() { throw 7 }, get height() { throw 7 }, data: new Uint8ClampedArray(10) }); +</script> |