diff options
Diffstat (limited to 'dom/html/crashtests')
108 files changed, 1529 insertions, 0 deletions
diff --git a/dom/html/crashtests/1032654.html b/dom/html/crashtests/1032654.html new file mode 100644 index 0000000000..3067e10770 --- /dev/null +++ b/dom/html/crashtests/1032654.html @@ -0,0 +1 @@ +<template>
# diff --git a/dom/html/crashtests/1141260.html b/dom/html/crashtests/1141260.html new file mode 100644 index 0000000000..c5ced3a447 --- /dev/null +++ b/dom/html/crashtests/1141260.html @@ -0,0 +1,4 @@ +<img src="foo" srcset="bar"> +<script> + document.querySelector("img").removeAttribute('src'); +</script> diff --git a/dom/html/crashtests/1228876.html b/dom/html/crashtests/1228876.html new file mode 100644 index 0000000000..b7beb645cf --- /dev/null +++ b/dom/html/crashtests/1228876.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var a = document.createElement("select"); + var f = document.createElement("optgroup"); + var g = document.createElement("optgroup"); + a.appendChild(f); + g.appendChild(document.createElement("option")); + f.appendChild(g); + a.appendChild(document.createElement("option")); + document.body.appendChild(a); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/html/crashtests/1230110.html b/dom/html/crashtests/1230110.html new file mode 100644 index 0000000000..4654641874 --- /dev/null +++ b/dom/html/crashtests/1230110.html @@ -0,0 +1,19 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> +// This test case should not leak. +function leak() +{ + var img = document.createElement("img"); + var iframe = document.createElement("iframe"); + img.appendChild(iframe); + document.body.appendChild(img); + + document.addEventListener('Foo', function(){}); +} +</script> +</head> +<body onload="leak();"></body> +</html> diff --git a/dom/html/crashtests/1237633.html b/dom/html/crashtests/1237633.html new file mode 100644 index 0000000000..c235f03158 --- /dev/null +++ b/dom/html/crashtests/1237633.html @@ -0,0 +1 @@ +<img srcset="data:,a 2400w" sizes="(min-width: 1px) calc(300px - 100vw)"> diff --git a/dom/html/crashtests/1281972-1.html b/dom/html/crashtests/1281972-1.html new file mode 100644 index 0000000000..6fa5bb250b --- /dev/null +++ b/dom/html/crashtests/1281972-1.html @@ -0,0 +1,5 @@ +<!DOCTYPE html> +<meta charset="UTF-8"> +<body onload="window[0].document.forms[0].submit();"> +<iframe src="data:text/html;charset=UTF-8,<form accept-charset=HZ-GB-2312>"></iframe> +</body> diff --git a/dom/html/crashtests/1282894.html b/dom/html/crashtests/1282894.html new file mode 100644 index 0000000000..456a4541fd --- /dev/null +++ b/dom/html/crashtests/1282894.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> + +function boom() { + var table = document.createElement("table"); + var cap = document.createElement("caption"); + cap.appendChild(table) + table.caption = cap; +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/html/crashtests/1290904.html b/dom/html/crashtests/1290904.html new file mode 100644 index 0000000000..5ea23ba3b6 --- /dev/null +++ b/dom/html/crashtests/1290904.html @@ -0,0 +1,37 @@ +<!DOCTYPE html> +<html> + <body> + <fieldset id="outer"> + <fieldset id="inner"> + </fieldset> + </fieldset> + </body> +</html> +<script> +function appendTextareaToFieldset(fieldset) { + var textarea = document.createElement("textarea"); + textarea.setAttribute("required", ""); + fieldset.appendChild(textarea); +} + +var innerFieldset = document.getElementById('inner'); +var outerFieldset = document.getElementById('outer'); + +var fieldset = document.createElement('fieldset'); +appendTextareaToFieldset(fieldset); +appendTextareaToFieldset(fieldset); +appendTextareaToFieldset(fieldset); +appendTextareaToFieldset(fieldset); + +// Adding a fieldset to a nested fieldset. +innerFieldset.appendChild(fieldset); +appendTextareaToFieldset(fieldset); +appendTextareaToFieldset(fieldset); +// This triggers mInvalidElementsCount checks in outer fieldset. +appendTextareaToFieldset(outerFieldset); + +// Removing a fieldset from a nested fieldset. +innerFieldset.removeChild(fieldset); +// This triggers mInvalidElementsCount checks in outer fieldset. +appendTextareaToFieldset(outerFieldset); +</script> diff --git a/dom/html/crashtests/1343886-1.html b/dom/html/crashtests/1343886-1.html new file mode 100644 index 0000000000..fe84959ac2 --- /dev/null +++ b/dom/html/crashtests/1343886-1.html @@ -0,0 +1,14 @@ +<!DOCTYPE html> +<html> + <head> + <script> + document.documentElement.scrollTop = "500"; + o1 = document.createRange(); + o2 = document.createElement('input'); + o1.selectNode(document.documentElement); + o1.surroundContents(o2); + o2.selectionStart; + </script> + </head> + <body></body> +</html>
\ No newline at end of file diff --git a/dom/html/crashtests/1343886-2.xml b/dom/html/crashtests/1343886-2.xml new file mode 100644 index 0000000000..91ddae103d --- /dev/null +++ b/dom/html/crashtests/1343886-2.xml @@ -0,0 +1,3 @@ +<input xmlns="http://www.w3.org/1999/xhtml"> + <script>document.documentElement.selectionStart</script> +</input> diff --git a/dom/html/crashtests/1343886-3.xml b/dom/html/crashtests/1343886-3.xml new file mode 100644 index 0000000000..a579a5e074 --- /dev/null +++ b/dom/html/crashtests/1343886-3.xml @@ -0,0 +1,3 @@ +<textarea xmlns="http://www.w3.org/1999/xhtml"> + <script>document.documentElement.selectionStart</script> +</textarea> diff --git a/dom/html/crashtests/1350972.html b/dom/html/crashtests/1350972.html new file mode 100644 index 0000000000..7af7f9e174 --- /dev/null +++ b/dom/html/crashtests/1350972.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html> +<head> +<script> + try { o1 = document.createElement('tr'); } catch(e) {}; + try { o2 = document.createElement('div'); } catch(e) {}; + try { o3 = document.createElement('hr'); } catch(e) {}; + try { o4 = document.createElement('textarea'); } catch(e) {}; + try { o5 = document.getSelection(); } catch(e) {}; + try { o6 = document.createRange(); } catch(e) {}; + try { document.documentElement.appendChild(o2); } catch(e) {}; + try { document.documentElement.appendChild(o3); } catch(e) {}; + try { o2.appendChild(o4); } catch(e) {}; + try { o3.outerHTML = "<noscript contenteditable='true'>"; } catch(e) {}; + try { o4.select(); } catch(e) {}; + try { o5.addRange(o6); } catch(e) {}; + try { document.documentElement.appendChild(o1); } catch(e) {}; + try { o5.selectAllChildren(o1); } catch(e) {}; + try { o6.selectNode(o1); } catch(e) {}; +</script> +</head> +</html>
\ No newline at end of file diff --git a/dom/html/crashtests/1386905.html b/dom/html/crashtests/1386905.html new file mode 100644 index 0000000000..6ecc59e23b --- /dev/null +++ b/dom/html/crashtests/1386905.html @@ -0,0 +1,13 @@ +<!DOCTYPE html> +<html> +<head> +<script> +document.documentElement.getBoundingClientRect() +document.documentElement.innerHTML = "<input placeholder=e type=number readonly>" +document.designMode = "on" +document.execCommand("inserttext", false, "") +document.designMode = "off" +document.documentElement.style.display = 'none' +</script> +</head> +</html> diff --git a/dom/html/crashtests/1401726.html b/dom/html/crashtests/1401726.html new file mode 100644 index 0000000000..bf4b4918ab --- /dev/null +++ b/dom/html/crashtests/1401726.html @@ -0,0 +1,17 @@ +<!DOCTYPE HTML> +<html> +<head> +<script> + try { o1 = document.createElement('button') } catch(e) { } + try { o2 = document.createElement('p') } catch(e) { } + try { o3 = o1.labels } catch(e) { } + try { o4 = document.createNSResolver(document.documentElement) } catch(e) { } + try { o5 = document.createRange(); } catch(e) { } + try { document.documentElement.appendChild(o1) } catch(e) { } + try { o5.selectNode(o4); } catch(e) { } + try { o5.surroundContents(o2) } catch(e) { } + try { o5.surroundContents(o2) } catch(e) { } + try { o1.labels.length } catch(e) { } +</script> +</head> +</html> diff --git a/dom/html/crashtests/1412173.html b/dom/html/crashtests/1412173.html new file mode 100644 index 0000000000..6989260cc7 --- /dev/null +++ b/dom/html/crashtests/1412173.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<head> +<script> +let f = document.createElement('frame'); +f.onload = function() { + let frameDocument = f.contentDocument; + frameDocument.body.onbeforeunload = function () { frameDocument.write('<p>beforeUnload</p>') }; + frameDocument.write('<p>trigger unload</p>') + window.stop(); + document.documentElement.className = ''; +}; +document.documentElement.appendChild(f); +</script> +</head> +<body> +</body> +</html> diff --git a/dom/html/crashtests/1429783.html b/dom/html/crashtests/1429783.html new file mode 100644 index 0000000000..211f9e7ee2 --- /dev/null +++ b/dom/html/crashtests/1429783.html @@ -0,0 +1,19 @@ +<!DOCTYPE HTML> +<html> + <head> + <script> + try { o2 = document.createElement('textarea') } catch(e) { } + try { o3 = document.getSelection() } catch(e) { } + try { document.documentElement.appendChild(o2) } catch(e) { } + try { o2.select() } catch(e) { } + try { o4 = o3.getRangeAt(0) } catch(e) { } + try { o5 = o4.commonAncestorContainer } catch(e) { } + try { o6 = o4.commonAncestorContainer } catch(e) { } + try { document.documentElement.after("", o5, "") } catch(e) { } + try { o4 = document.createElement('t') } catch(e) { } + try { document.appendChild(o4); } catch(e) { } + try { document.write(atob("PHNjcmlwdCBzcmM9Jyc+PC9zY3JpcHQ+Cg==")) } catch(e) { } + try { document.replaceChild(o6, document.documentElement); } catch(e) { } + </script> + </head> +</html> diff --git a/dom/html/crashtests/1440523.html b/dom/html/crashtests/1440523.html new file mode 100644 index 0000000000..11ce699781 --- /dev/null +++ b/dom/html/crashtests/1440523.html @@ -0,0 +1,13 @@ +<html> + <head> + <script> + try { frame = document.createElement('frame') } catch(e) { } + try { document.documentElement.appendChild(frame) } catch(e) { } + try { contentDocument = frame.contentDocument } catch(e) { } + try { contentDocument.writeln("<p contenteditable='true'>") } catch(e) { } + try { anotherDocument = document.implementation.createHTMLDocument(); } catch(e) { } + try { rootOfAnotherDocument = anotherDocument.documentElement; } catch(e) { } + try { document.replaceChild(rootOfAnotherDocument, document.documentElement); } catch(e) { } + </script> + </head> +</html> diff --git a/dom/html/crashtests/1440827.html b/dom/html/crashtests/1440827.html new file mode 100644 index 0000000000..ee204212ff --- /dev/null +++ b/dom/html/crashtests/1440827.html @@ -0,0 +1,6 @@ +<html> +<head> +<meta charset="UTF-8"> +> +<meta content='referrer no-referrer;manifest-src self http:' http-equiv='Content-Security-Policy'> +<script src='http://zzzzzz.z'></script> diff --git a/dom/html/crashtests/1547057.html b/dom/html/crashtests/1547057.html new file mode 100644 index 0000000000..89f48b5344 --- /dev/null +++ b/dom/html/crashtests/1547057.html @@ -0,0 +1,11 @@ +<html> +<head> + <script> + function start() { + const iframe = document.createElement('iframe') + iframe.policy.allowedFeatures() + } + window.addEventListener('load', start) + </script> +</head> +</html> diff --git a/dom/html/crashtests/1550524.html b/dom/html/crashtests/1550524.html new file mode 100644 index 0000000000..1b41f527dc --- /dev/null +++ b/dom/html/crashtests/1550524.html @@ -0,0 +1,7 @@ +<iframe></iframe> +<script> + var doc = frames[0].document; + doc.open(); + doc.open(); + doc.close(); +</script> diff --git a/dom/html/crashtests/1550881-1.html b/dom/html/crashtests/1550881-1.html new file mode 100644 index 0000000000..b9d73df957 --- /dev/null +++ b/dom/html/crashtests/1550881-1.html @@ -0,0 +1,13 @@ +<!DOCTYPE html> +<iframe srcdoc="<iframe></iframe>"></iframe> +<script> + onload = function() { + parent = frames[0]; + child = parent[0]; + child.onunload = function() { + parent.document.open(); + } + parent.document.open(); + parent.document.write("Hello"); + } +</script> diff --git a/dom/html/crashtests/1550881-2.html b/dom/html/crashtests/1550881-2.html new file mode 100644 index 0000000000..97bf5ef350 --- /dev/null +++ b/dom/html/crashtests/1550881-2.html @@ -0,0 +1,14 @@ +<!DOCTYPE html> +<iframe srcdoc="<iframe></iframe>"></iframe> +<script> + onload = function() { + parent = frames[0]; + child = parent[0]; + child.onunload = function() { + parent.document.open(); + parent.document.write("Nested"); + } + parent.document.open(); + parent.document.write("Hello"); + } +</script> diff --git a/dom/html/crashtests/1667493.html b/dom/html/crashtests/1667493.html new file mode 100644 index 0000000000..d7cf6c6174 --- /dev/null +++ b/dom/html/crashtests/1667493.html @@ -0,0 +1,13 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<script> +function runTest() { + let win = window.open("1667493_1.html"); + win.finish = function() { + document.documentElement.removeAttribute("class"); + }; +} +</script> +<body onload="runTest()"> +</body> +</html> diff --git a/dom/html/crashtests/1667493_1.html b/dom/html/crashtests/1667493_1.html new file mode 100644 index 0000000000..9b1a5fc047 --- /dev/null +++ b/dom/html/crashtests/1667493_1.html @@ -0,0 +1,7 @@ +<script> +window.requestIdleCallback(() => { + window.close(); + finish(); +}); +</script> +<input required="" value="r" type="number"> diff --git a/dom/html/crashtests/1680418.html b/dom/html/crashtests/1680418.html new file mode 100644 index 0000000000..ccebe0ed33 --- /dev/null +++ b/dom/html/crashtests/1680418.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<script> +window.addEventListener("hashchange", function() { + document.documentElement.removeAttribute("class"); +}); + +async function runTest() { + document.getElementById("a").click(); + await new Promise(resolve => setTimeout(resolve, 0)); + document.location.hash = "#foo"; +} +</script> +<body onload="runTest()"> +<a id='a' type='text/html' href='telnet://'> +</body> +</html> diff --git a/dom/html/crashtests/1704660.html b/dom/html/crashtests/1704660.html new file mode 100644 index 0000000000..01497975df --- /dev/null +++ b/dom/html/crashtests/1704660.html @@ -0,0 +1,17 @@ +<html> + <head> + <script> + function test() { + var ifr = document.getElementsByTagName("iframe")[0]; + var form = ifr.contentDocument.getElementsByTagName("form")[0]; + form.onsubmit = function() { + ifr.remove() + } + form.lastChild.click(); + } + </script> + </head> + <body onload="test()"> + <iframe srcdoc="<form><input name=f type=file><button></button></form>"></iframe> + </body> +</html> diff --git a/dom/html/crashtests/1724816.html b/dom/html/crashtests/1724816.html new file mode 100644 index 0000000000..9264a5225f --- /dev/null +++ b/dom/html/crashtests/1724816.html @@ -0,0 +1,14 @@ +<script> +window.onload = () => { + window[0].focus() + a.close() + a.showModal() + document.execCommand("selectAll", false) +} +function go() { + document.onselectstart = document.createElement("frameset").onload +} +</script> +<details open="true" ontoggle="go()">a</details> +<iframe></iframe> +<dialog id="a" tabindex="3">a</dialog> diff --git a/dom/html/crashtests/1785933-inner.html b/dom/html/crashtests/1785933-inner.html new file mode 100644 index 0000000000..8c97da8a8e --- /dev/null +++ b/dom/html/crashtests/1785933-inner.html @@ -0,0 +1,28 @@ +<style> +* { + image-rendering: pixelated; +} +</style> +<script> +window.requestIdleCallback(() => { + a.setSelectionRange(-1, 1) + document.head.innerHTML = undefined +}) +</script> +<embed src="data:image/gif;base64,R0lGODlhAQABAAD/ACwAAAAAAQABAAACADs="></embed> +<textarea id="a">aaaaaaaaaaaaaaaa</textarea> +<script> + const embed = document.querySelector("embed"); + embed.onload = function() { + var countdown = 20; + if (location.search) { + countdown = parseInt(location.search.slice(1)) - 1; + } + + if (countdown > 0) { + location.search = countdown; + } else { + window.parent.postMessage("done", "*"); + } + } +</script> diff --git a/dom/html/crashtests/1785933.html b/dom/html/crashtests/1785933.html new file mode 100644 index 0000000000..e73395faea --- /dev/null +++ b/dom/html/crashtests/1785933.html @@ -0,0 +1,10 @@ +<html class="reftest-wait"> +<body> + <iframe src="./1785933-inner.html"></iframe> + <script> + window.onmessage = function() { + document.documentElement.removeAttribute("class"); + } + </script> +</body> +</html> diff --git a/dom/html/crashtests/1787671.html b/dom/html/crashtests/1787671.html new file mode 100644 index 0000000000..5f891386af --- /dev/null +++ b/dom/html/crashtests/1787671.html @@ -0,0 +1,8 @@ +<!DOCTYPE html> +<script> +document.addEventListener('DOMContentLoaded', () => { + window.print(); + setTimeout(window.close, 250); +}) +</script> +<img srcset="#"></img> diff --git a/dom/html/crashtests/1789475.html b/dom/html/crashtests/1789475.html new file mode 100644 index 0000000000..f12924a742 --- /dev/null +++ b/dom/html/crashtests/1789475.html @@ -0,0 +1,10 @@ +<!DOCTYPE html> +<script> +window.addEventListener('load', () => { + let a = document.createElement("img"); + a.srcset = "1"; + let b = new DOMParser() + let c = b.parseFromString("<div></div>", "text/html") + c.adoptNode(a) +}) +</script> diff --git a/dom/html/crashtests/1801380.html b/dom/html/crashtests/1801380.html new file mode 100644 index 0000000000..f4ce3e109f --- /dev/null +++ b/dom/html/crashtests/1801380.html @@ -0,0 +1 @@ +<input dir="auto" type="tel"> diff --git a/dom/html/crashtests/257818-1.html b/dom/html/crashtests/257818-1.html new file mode 100644 index 0000000000..27929fd793 --- /dev/null +++ b/dom/html/crashtests/257818-1.html @@ -0,0 +1,82 @@ +<html><head> +<script type="text/javascript"> +function cE (v) { + return document.createElement(v) +} +function cTN (v) { + return document.createTextNode(v) +} + +function OSXBarIcon(elt) { + this.element = elt; + this.labelNode = this.element.firstChild; + this.labelNodeParent = this.element; + this.labelNodeParent.removeChild(this.labelNode); + + this.contents = []; + var kids = this.element.childNodes; + for(var i=0; i<kids.length; i++) this.contents[this.contents.length] = this.element.removeChild(kids[i]); + this.popupSubmenu = new OSXBarSubmenu(this); +} + +function OSXBarSubmenu(icon) { + this.parentIcon = icon; + this.create(); + this.addContent(); +} +OSXBarSubmenu.prototype = { + create : function() { + var p = this.popupNode = document.createElement("div"); + var b = document.getElementsByTagName("body").item(0); + if(b) b.appendChild(p); + this.popupNode.style.display = "none"; + // Uncomment next line to fix the problem +// var v = document.body.offsetWidth; + } +}; +OSXBarSubmenu.prototype.addContent = function() { + + // add popup label: + var label = document.createElement("div"); + label.appendChild(document.createTextNode(this.parentIcon.label)); + this.popupNode.appendChild(label); + + // add <li> children to the popup: + var contents = this.parentIcon.contents; + for(var i=0; i<contents.length; i++) { + this.popupNode.appendChild(contents[i]); + + } +}; + +</script> + +<script type="text/javascript"> +function createControlPanel() { + var bar = document.getElementById("navigation"); + var item = cE("li"); + item.appendChild(cTN("aaa")); + var textfield = cE("input"); + textfield.value = 0; + item.appendChild(textfield); + bar.insertBefore(item, bar.firstChild); +} + +window.addEventListener("load", createControlPanel); +</script> + +<script type="text/javascript"> +function ssload() { + new OSXBarIcon(document.getElementById("navigation").childNodes[0]); +} +window.addEventListener("load",ssload); + + +</script> +</head> + +<body> +<ul id="navigation"></ul> +</body></html> + + diff --git a/dom/html/crashtests/285166-1.html b/dom/html/crashtests/285166-1.html new file mode 100644 index 0000000000..8a73d7d74e --- /dev/null +++ b/dom/html/crashtests/285166-1.html @@ -0,0 +1,3 @@ +<script> +document.createElement("#text"); +</script> diff --git a/dom/html/crashtests/294235-1.html b/dom/html/crashtests/294235-1.html new file mode 100644 index 0000000000..00eed38f4e --- /dev/null +++ b/dom/html/crashtests/294235-1.html @@ -0,0 +1,14 @@ +<html> + <head> + <title>bug 294235</title> + <script> + function countdown(){ + count2.innerHTML="foo"; + } + document.links.length; + </script> + </head> + <body> + <strong><div id="count2"><script>countdown();</script><noscript>bar</noscript></div></strong> + </body> +</html> diff --git a/dom/html/crashtests/307616-1.html b/dom/html/crashtests/307616-1.html new file mode 100644 index 0000000000..8f28ddd6e8 --- /dev/null +++ b/dom/html/crashtests/307616-1.html @@ -0,0 +1,8 @@ +<html> +<head><title>Testcase for assertion</title></head> +<body> +
+<input type="image" src="./nosuch.gif" alt="Search"> + +</body> +</html>
\ No newline at end of file diff --git a/dom/html/crashtests/324918-1.xhtml b/dom/html/crashtests/324918-1.xhtml new file mode 100644 index 0000000000..921714cff3 --- /dev/null +++ b/dom/html/crashtests/324918-1.xhtml @@ -0,0 +1,26 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script> + + +function init() +{ + var sel = document.getElementById("sel"); + var div = document.getElementById("div"); + var newo = document.createElementNS("http://www.w3.org/1999/xhtml", "option"); + + sel.appendChild(div); + div.appendChild(newo); + sel.removeChild(div); +} + +</script> +</head> +<body onload="init();"> + +<div id="div"><option></option></div> + +<select id="sel"></select> + +</body> +</html> diff --git a/dom/html/crashtests/338649-1.xhtml b/dom/html/crashtests/338649-1.xhtml new file mode 100644 index 0000000000..b0bf3186fc --- /dev/null +++ b/dom/html/crashtests/338649-1.xhtml @@ -0,0 +1,22 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<title>ASSERTION: Options collection broken</title> +</head> + +<body> + +<div> + +<select> + <option id="n29">B + <optgroup label="middle" id="n20"> + <option>N</option> + </optgroup> + </option> + <option>M</option> +</select> + +</div> + +</body> +</html>
\ No newline at end of file diff --git a/dom/html/crashtests/339501-1.xhtml b/dom/html/crashtests/339501-1.xhtml new file mode 100644 index 0000000000..1a231ee645 --- /dev/null +++ b/dom/html/crashtests/339501-1.xhtml @@ -0,0 +1,33 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> + +<script> + +function boom() +{ + document.addEventListener("DOMNodeRemoved", foo, false); + remove(document.getElementById("A")); + document.removeEventListener("DOMNodeRemoved", foo, false); + + function foo() + { + document.removeEventListener("DOMNodeRemoved", foo, false); + remove(document.getElementById("B")); + } +} + + +window.addEventListener("load", boom, false); + +function remove(q1) { q1.parentNode.removeChild(q1); } + +</script> + +</head> + +<body> + +<select><option id="A">A</option><option id="B">B</option></select> + +</body> +</html> diff --git a/dom/html/crashtests/339501-2.xhtml b/dom/html/crashtests/339501-2.xhtml new file mode 100644 index 0000000000..6a1835fb71 --- /dev/null +++ b/dom/html/crashtests/339501-2.xhtml @@ -0,0 +1,33 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> + +<script> + +function boom() +{ + document.addEventListener("DOMNodeRemoved", foo, false); + remove(document.getElementById("B")); + document.removeEventListener("DOMNodeRemoved", foo, false); + + function foo() + { + document.removeEventListener("DOMNodeRemoved", foo, false); + remove(document.getElementById("A")); + } +} + + +window.addEventListener("load", boom, false); + +function remove(q1) { q1.parentNode.removeChild(q1); } + +</script> + +</head> + +<body> + +<select><option id="A">A</option><option id="B">B</option></select> + +</body> +</html> diff --git a/dom/html/crashtests/378993-1.xhtml b/dom/html/crashtests/378993-1.xhtml new file mode 100644 index 0000000000..99cbb01dae --- /dev/null +++ b/dom/html/crashtests/378993-1.xhtml @@ -0,0 +1,7 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<body> +<script> +document.createElement('AREA'); +</script> +</body> +</html> diff --git a/dom/html/crashtests/382568-1-inner.xhtml b/dom/html/crashtests/382568-1-inner.xhtml new file mode 100644 index 0000000000..67d7427582 --- /dev/null +++ b/dom/html/crashtests/382568-1-inner.xhtml @@ -0,0 +1,52 @@ +<?xml version="1.0"?> +<!DOCTYPE html +PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" +"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> +<html xmlns="http://www.w3.org/1999/xhtml"> <head> +<title>Test</title> +<script type="text/javascript"><![CDATA[ + +function onAttrModified(evt) { +// window.alert("Mutation event fired within the frame code."); +// evt.target.focus(); +// evt.target.blur(); + evt.target.style.background = 'green'; + bounce(evt.target); +// evt.target.normalize(); +// bounce(evt.target.parentNode); +} +function die(n) { + p = n.parentNode; + p.removeChild(n); +} + +function bounce(n) { + p = n.parentNode; + p.removeChild(n); + p.appendChild(n); +} + + +function test_AttrModified() { + var x = document.getElementById("x"); + x.addEventListener("DOMAttrModified", onAttrModified); + bounce(x); +} + +function test() { + setTimeout(test_AttrModified, 3000); +} +]]></script> +</head> + +<body onload="test()"> +<h1>TestCase for unsafe mutable events from textarea</h1> +<p>Please wait for 3 seconds after document was loaded, +if your browser is vulnerable, it may stop responding +to keyboard and mouse event +and most likely it will eventually crash (may take a +while for debug builds).</p> +<p> +<textarea id="x"></textarea> +</p> +</body> </html> diff --git a/dom/html/crashtests/382568-1.html b/dom/html/crashtests/382568-1.html new file mode 100644 index 0000000000..c10c71fd14 --- /dev/null +++ b/dom/html/crashtests/382568-1.html @@ -0,0 +1,9 @@ +<html class="reftest-wait"> +<head> +<script> +setTimeout('document.documentElement.className = ""', 3500); +</script> +<body> +<iframe src="382568-1-inner.xhtml"></iframe> +</body> +</html> diff --git a/dom/html/crashtests/383137.xhtml b/dom/html/crashtests/383137.xhtml new file mode 100644 index 0000000000..87d853c035 --- /dev/null +++ b/dom/html/crashtests/383137.xhtml @@ -0,0 +1,13 @@ +<html xmlns="http://www.w3.org/1999/xhtml">
+<script id="script" xmlns="http://www.w3.org/1999/xhtml">//<![CDATA[
+function doe(){
+document.documentElement.setAttribute('style', '');
+}
+
+setTimeout(doe,100);
+//]]></script>
+
+<style style="overflow: scroll; display: block;">
+style::before {content: counter(section); }
+</style>
+</html>
\ No newline at end of file diff --git a/dom/html/crashtests/388183-1.html b/dom/html/crashtests/388183-1.html new file mode 100644 index 0000000000..fcca410e93 --- /dev/null +++ b/dom/html/crashtests/388183-1.html @@ -0,0 +1,8 @@ +<!DOCTYPE html> +<html contenteditable="true"> +<head> +</head> +<body> +<div contenteditable="true"></div> +</body> +</html> diff --git a/dom/html/crashtests/395340-1.html b/dom/html/crashtests/395340-1.html new file mode 100644 index 0000000000..ddbccfe968 --- /dev/null +++ b/dom/html/crashtests/395340-1.html @@ -0,0 +1,28 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script type="text/javascript"> + +function boom() +{ + var div1 = document.createElement("div"); + div1.style.counterIncrement = "chicken"; + div1.contentEditable = "true"; + + var div2 = document.createElement("div"); + div2.style.counterIncrement = "chicken"; + + document.body.style.content = "'A'"; + + div1.appendChild(div2); + document.body.appendChild(div1); + div1.removeChild(div2); +} + +</script> + +</head> + +<body onload="boom();"> + +</body> +</html> diff --git a/dom/html/crashtests/399694-1.html b/dom/html/crashtests/399694-1.html new file mode 100644 index 0000000000..e6db2342b5 --- /dev/null +++ b/dom/html/crashtests/399694-1.html @@ -0,0 +1,20 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait"> +<head> +<script> +function boom() +{ + var legend = document.createElementNS("http://www.w3.org/1999/xhtml", "legend") + var input = document.getElementById("input"); + input.appendChild(legend); + legend.focus(); + + document.documentElement.removeAttribute("class"); +} +</script> +</head> +<body onload="setTimeout(boom, 3);" contenteditable="true"> + +<input contenteditable="false"><input id="input"><q><div></div></q> + +</body> +</html> diff --git a/dom/html/crashtests/407053.html b/dom/html/crashtests/407053.html new file mode 100644 index 0000000000..b80a231722 --- /dev/null +++ b/dom/html/crashtests/407053.html @@ -0,0 +1,6 @@ +<!DOCTYPE html> +<html> +<body onload="document.execCommand('copy', false, '');"> +<div contenteditable="true"></div> +</body> +</html> diff --git a/dom/html/crashtests/423371-1.html b/dom/html/crashtests/423371-1.html new file mode 100644 index 0000000000..0069cf95db --- /dev/null +++ b/dom/html/crashtests/423371-1.html @@ -0,0 +1,9 @@ +<!DOCTYPE HTML> +<html> +<body> +<div style="position:fixed; top:100px;" id="d">hello</div> +<script> +document.write(document.getElementById("d").offsetTop); +</script> +</body> +</html> diff --git a/dom/html/crashtests/448564.html b/dom/html/crashtests/448564.html new file mode 100644 index 0000000000..f31830afa1 --- /dev/null +++ b/dom/html/crashtests/448564.html @@ -0,0 +1,7 @@ +<s> +<form>a</form> +<iframe></iframe> +<script src=a></script> +<form></form> +<table> +<optgroup> diff --git a/dom/html/crashtests/451123-1.html b/dom/html/crashtests/451123-1.html new file mode 100644 index 0000000000..abf23c1e73 --- /dev/null +++ b/dom/html/crashtests/451123-1.html @@ -0,0 +1,7 @@ +<html> +<head> +</head> +<body> +<input type="file" type="file"> +</body> +</html> diff --git a/dom/html/crashtests/453406-1.html b/dom/html/crashtests/453406-1.html new file mode 100644 index 0000000000..bf75686553 --- /dev/null +++ b/dom/html/crashtests/453406-1.html @@ -0,0 +1,34 @@ +<html> +<head> +<script type="text/javascript"> +function boom() +{ + var r = document.documentElement; + while (r.firstChild) + r.firstChild.remove(); + + var b = document.createElement("BODY"); + var s = document.createElement("SCRIPT"); + var f1 = document.createElement("FORM"); + var i = document.createElement("INPUT"); + var br = document.createElement("BR"); + var f2 = document.createElement("FORM"); + var span = document.createElement("SPAN"); + f1.appendChild(i); + f1.appendChild(br); + s.appendChild(f1); + b.appendChild(s); + f2.appendChild(span); + b.appendChild(f2) + document.documentElement.appendChild(b); + b.contentEditable = "true"; + document.execCommand("indent", false, null); + b.contentEditable = "false"; + span.appendChild(i); + i.remove(); +} +</script> +</head> +<body onload="boom();"> +</body> +</html> diff --git a/dom/html/crashtests/464197-1.html b/dom/html/crashtests/464197-1.html new file mode 100644 index 0000000000..785686023e --- /dev/null +++ b/dom/html/crashtests/464197-1.html @@ -0,0 +1,23 @@ +<html class="reftest-wait"> +<head> +<script type="text/javascript"> + +var i = 0; + +function boom() +{ + var s = document.createElement("span"); + s.innerHTML = "<audio src='javascript:5'><\/audio>"; + s.innerHTML = ""; + + if (++i < 10) + setTimeout(boom, 0); + else + document.documentElement.removeAttribute("class"); +} + +</script> +</head> +<body onload="boom();"> +</body> +</html> diff --git a/dom/html/crashtests/468562-1.html b/dom/html/crashtests/468562-1.html new file mode 100644 index 0000000000..81123fe2ea --- /dev/null +++ b/dom/html/crashtests/468562-1.html @@ -0,0 +1,6 @@ +<html> +<head></head> +<body> +<table><script>document.write("Q");</script><link> +</body> +</html> diff --git a/dom/html/crashtests/468562-2.html b/dom/html/crashtests/468562-2.html new file mode 100644 index 0000000000..e0db5cd974 --- /dev/null +++ b/dom/html/crashtests/468562-2.html @@ -0,0 +1,6 @@ +<html> +<head></head> +<body> +<table><script>document.write("Q");</script><link></table> +</body> +</html> diff --git a/dom/html/crashtests/494225.html b/dom/html/crashtests/494225.html new file mode 100644 index 0000000000..a78051d2a1 --- /dev/null +++ b/dom/html/crashtests/494225.html @@ -0,0 +1,10 @@ +<!doctype html> +<html><head><script> + var x = "f: '" + document.fgColor + + "' b: '" + document.bgColor + + "' l: '" + document.linkColor + + "' a: '" + document.alinkColor + + "' v: '" + document.vlinkColor + "'"; +</script></head><body +onload="document.body.appendChild(document.createTextNode(x))" +></body></html> diff --git a/dom/html/crashtests/495543.svg b/dom/html/crashtests/495543.svg new file mode 100644 index 0000000000..b795796ad4 --- /dev/null +++ b/dom/html/crashtests/495543.svg @@ -0,0 +1,16 @@ +<svg xmlns="http://www.w3.org/2000/svg"> +<script type="text/javascript"> + +function boom() +{ + var htmlBody = document.createElementNS("http://www.w3.org/1999/xhtml", "body"); + document.documentElement.appendChild(htmlBody); + htmlBody.setAttribute('vlink', "transparent"); + document.height; + document.vlinkColor; +} + +window.addEventListener("load", boom, false); +</script> + +</svg> diff --git a/dom/html/crashtests/495546-1.html b/dom/html/crashtests/495546-1.html new file mode 100644 index 0000000000..0547b98674 --- /dev/null +++ b/dom/html/crashtests/495546-1.html @@ -0,0 +1,19 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script type="text/javascript"> + +function boom() +{ + var video = document.createElement("video"); + var source = document.createElement("source"); + source.setAttributeNS(null, "src", "http://127.0.0.1/"); + video.appendChild(source); + document.body.appendChild(video); + setTimeout(function() { document.body.removeChild(video); }, 20); +} + +</script> +</head> + +<body onload="boom();"></body> +</html> diff --git a/dom/html/crashtests/504183-1.html b/dom/html/crashtests/504183-1.html new file mode 100644 index 0000000000..e44db41520 --- /dev/null +++ b/dom/html/crashtests/504183-1.html @@ -0,0 +1,12 @@ +<html class="reftest-wait"> +<input id="a" type="file"> +<script> +function doe() { +var elem = document.getElementById('a'); +elem.style.display = "none"; +elem.focus(); +document.documentElement.className = ""; +} +setTimeout(doe, 0); +</script> +</html> diff --git a/dom/html/crashtests/515829-1.html b/dom/html/crashtests/515829-1.html new file mode 100644 index 0000000000..e2fc655c01 --- /dev/null +++ b/dom/html/crashtests/515829-1.html @@ -0,0 +1,7 @@ +<!DOCTYPE html> +<html> +<head></head> +<body onload="document.getElementById('x').innerHTML = '<button></button>';"> +<form><div id="x"><button></button></div><button></button></form> +</body> +</html> diff --git a/dom/html/crashtests/515829-2.html b/dom/html/crashtests/515829-2.html new file mode 100644 index 0000000000..6de6d5986c --- /dev/null +++ b/dom/html/crashtests/515829-2.html @@ -0,0 +1,7 @@ +<!DOCTYPE html> +<html> +<head></head> +<body onload="document.getElementById('x').innerHTML = '<button></button>';"> +<form><div id="x"><button></button></div><button></button><input type="image"></form> +</body> +</html> diff --git a/dom/html/crashtests/570566-1.html b/dom/html/crashtests/570566-1.html new file mode 100644 index 0000000000..70ec003a68 --- /dev/null +++ b/dom/html/crashtests/570566-1.html @@ -0,0 +1,2 @@ +<body onload="document.getElementById('i').removeAttribute('type')"><input id=i type=image></body> + diff --git a/dom/html/crashtests/571428-1.html b/dom/html/crashtests/571428-1.html new file mode 100644 index 0000000000..ae2b960cac --- /dev/null +++ b/dom/html/crashtests/571428-1.html @@ -0,0 +1,14 @@ +<!DOCTYPE html> +<html> +<head> +<script> +function boom() +{ + var i = document.getElementById("i"); + i.setAttribute("type", "button"); + i.removeAttribute("type"); +} +</script> +</head> +<body onload="boom();"><input id="i"></body> +</html> diff --git a/dom/html/crashtests/580507-1.xhtml b/dom/html/crashtests/580507-1.xhtml new file mode 100644 index 0000000000..eff3fb255d --- /dev/null +++ b/dom/html/crashtests/580507-1.xhtml @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var input = document.getElementById("i"); + input.setAttribute('type', "image"); + input.removeAttribute('type'); + input.placeholder = "Y"; +} + +</script> +</head> + +<body onload="boom();"><input id="i" /></body> +</html> diff --git a/dom/html/crashtests/590387.html b/dom/html/crashtests/590387.html new file mode 100644 index 0000000000..50cd05ac9e --- /dev/null +++ b/dom/html/crashtests/590387.html @@ -0,0 +1,8 @@ +<!DOCTYPE html> +<html> +<head> +<script> +document.createElement("div").innerHTML = "<output form=x>"; +</script> +</head> +</html> diff --git a/dom/html/crashtests/596785-1.html b/dom/html/crashtests/596785-1.html new file mode 100644 index 0000000000..5d830628b0 --- /dev/null +++ b/dom/html/crashtests/596785-1.html @@ -0,0 +1,9 @@ +<!DOCTYPE html> +<html class="reftest-wait"> + <body onload="document.getElementById('i').type = 'image'; + document.documentElement.className = '';"> + <form> + <input id='i' required> + </form> + </body> +</html> diff --git a/dom/html/crashtests/596785-2.html b/dom/html/crashtests/596785-2.html new file mode 100644 index 0000000000..18cfe2788d --- /dev/null +++ b/dom/html/crashtests/596785-2.html @@ -0,0 +1,9 @@ +<!DOCTYPE html> +<html class="reftest-wait"> + <body onload="document.getElementById('i').type = 'text'; + document.documentElement.className = '';"> + <form> + <input id='i' type='image' required> + </form> + </body> +</html> diff --git a/dom/html/crashtests/602117.html b/dom/html/crashtests/602117.html new file mode 100644 index 0000000000..0d1818b2a9 --- /dev/null +++ b/dom/html/crashtests/602117.html @@ -0,0 +1,8 @@ +<!DOCTYPE html> +<html> + <script> + var isindex = document.createElement("isindex"); + isindex.setAttribute("form", "f"); + isindex.form; + </script> +</html> diff --git a/dom/html/crashtests/604807.html b/dom/html/crashtests/604807.html new file mode 100644 index 0000000000..bec4012e5c --- /dev/null +++ b/dom/html/crashtests/604807.html @@ -0,0 +1,9 @@ +<!DOCTYPE html> +<script> +try { + var selectElem = document.createElementNS("http://www.w3.org/1999/xhtml", "select"); + selectElem.QueryInterface(Ci.nsISelectElement); + selectElem.getOptionIndex(null, 0, true); +} catch (e) { +} +</script> diff --git a/dom/html/crashtests/605264.html b/dom/html/crashtests/605264.html new file mode 100644 index 0000000000..782720a9d6 --- /dev/null +++ b/dom/html/crashtests/605264.html @@ -0,0 +1,8 @@ +<!DOCTYPE html> +<script> + +var v = document.createElementNS("http://www.w3.org/1999/xhtml", "video"); +v.QueryInterface(Ci.nsIObserver); +v.observe(null, null, null); + +</script> diff --git a/dom/html/crashtests/606430-1.html b/dom/html/crashtests/606430-1.html new file mode 100644 index 0000000000..c347e3c9f1 --- /dev/null +++ b/dom/html/crashtests/606430-1.html @@ -0,0 +1,31 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var r = document.documentElement; + var i = document.getElementById("i"); + + document.removeChild(r); + document.appendChild(r); + w("dump('A\\n')"); + document.removeChild(r); + w("dump('B\\n')"); + document.appendChild(r); + + function w(s) + { + var ns = document.createElement("script"); + var nt = document.createTextNode(s); + ns.appendChild(nt); + i.appendChild(ns); + } +} + +</script> +</head> + +<body onload="boom();"><input id="i"></body> +</html> diff --git a/dom/html/crashtests/613027.html b/dom/html/crashtests/613027.html new file mode 100644 index 0000000000..a866860f10 --- /dev/null +++ b/dom/html/crashtests/613027.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var a = document.createElementNS("http://www.w3.org/1999/xhtml", "fieldset"); + var b = document.createElementNS("http://www.w3.org/1999/xhtml", "legend"); + var c = document.createElementNS("http://www.w3.org/1999/xhtml", "input"); + + a.appendChild(b); + a.appendChild(c); + a.removeChild(b); + c.expandoQ = a; +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/html/crashtests/614279.html b/dom/html/crashtests/614279.html new file mode 100644 index 0000000000..ff1c505167 --- /dev/null +++ b/dom/html/crashtests/614279.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var a = document.createElementNS("http://www.w3.org/1999/xhtml", "datalist"); + var b = document.createElementNS("http://www.w3.org/1999/xhtml", "option"); + + a.appendChild(b); + b.expando = a.options; +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/html/crashtests/614988-1.html b/dom/html/crashtests/614988-1.html new file mode 100644 index 0000000000..931f83ac73 --- /dev/null +++ b/dom/html/crashtests/614988-1.html @@ -0,0 +1,5 @@ +<!DOCTYPE html> +<html> +<head><script>window.addEventListener("load", function() { var t = document.getElementById("t"); t.appendChild(t.previousSibling); }, false);</script></head> +<body><fieldset><legend></legend><textarea id="t"></textarea></fieldset></body> +</html> diff --git a/dom/html/crashtests/616401.html b/dom/html/crashtests/616401.html new file mode 100644 index 0000000000..eb5a0bcf4c --- /dev/null +++ b/dom/html/crashtests/616401.html @@ -0,0 +1,8 @@ +<!doctype html> +<script> +var c = document.createElement("canvas"); +c.getContext("experimental-webgl", { + get a() { throw 7; }, + get b() { throw 8; } +}); +</script> diff --git a/dom/html/crashtests/620078-1.html b/dom/html/crashtests/620078-1.html new file mode 100644 index 0000000000..39462706c1 --- /dev/null +++ b/dom/html/crashtests/620078-1.html @@ -0,0 +1,20 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var frame = document.getElementById("f"); + var frameRoot = frame.contentDocument.documentElement; + document.body.removeChild(frame); + var i = document.createElementNS("http://www.w3.org/1999/xhtml", "input"); + i.setAttribute("autofocus", "true"); + frameRoot.appendChild(i); +} + +</script> +</head> + +<body onload="boom();"><iframe id="f" src="data:text/html,"></iframe></body> +</html> diff --git a/dom/html/crashtests/620078-2.html b/dom/html/crashtests/620078-2.html new file mode 100644 index 0000000000..1be23fa1f2 --- /dev/null +++ b/dom/html/crashtests/620078-2.html @@ -0,0 +1,6 @@ +<!DOCTYPE html> +<html> + <body onload='document.cloneNode(1)'> + <button autofocus></button> + </body> +</html> diff --git a/dom/html/crashtests/631421.html b/dom/html/crashtests/631421.html new file mode 100644 index 0000000000..e4a7b9192b --- /dev/null +++ b/dom/html/crashtests/631421.html @@ -0,0 +1,34 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<head> +<script> +"use strict"; + +var f2; + +function newIframe() +{ + var f = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe"); + f.setAttributeNS(null, "src", "631421.png"); + document.body.appendChild(f); + return f; +} + +function b1() +{ + void newIframe(); + f2 = newIframe(); + setTimeout(b2, 0); +} + +function b2() +{ + document.body.removeChild(f2); + document.documentElement.removeAttribute("class"); +} + +</script> +</head> + +<body onload="b1();"></body> +</html> diff --git a/dom/html/crashtests/631421.png b/dom/html/crashtests/631421.png Binary files differnew file mode 100644 index 0000000000..ef350c4678 --- /dev/null +++ b/dom/html/crashtests/631421.png diff --git a/dom/html/crashtests/673853.html b/dom/html/crashtests/673853.html new file mode 100644 index 0000000000..1325fa9ed6 --- /dev/null +++ b/dom/html/crashtests/673853.html @@ -0,0 +1,20 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var otherDoc = document.implementation.createDocument('', '', null); + var input = otherDoc.createElementNS("http://www.w3.org/1999/xhtml", "input"); + var form = otherDoc.createElementNS("http://www.w3.org/1999/xhtml", "form"); + input.setAttributeNS(null, "form", "x"); + form.setAttributeNS(null, "id", "x"); + input.appendChild(form); + otherDoc.appendChild(input); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/html/crashtests/682058.xhtml b/dom/html/crashtests/682058.xhtml new file mode 100644 index 0000000000..95e7da98fc --- /dev/null +++ b/dom/html/crashtests/682058.xhtml @@ -0,0 +1,11 @@ +<?xml version="1.0"?> +<html xmlns="http://www.w3.org/1999/xhtml"> + <body onload="test()"> + <script> + function test() { + document.body.innerHTML = "Foobar"; + } + document.addEventListener("DOMNodeRemoved", function() {}); + </script> + </body> +</html> diff --git a/dom/html/crashtests/682460.html b/dom/html/crashtests/682460.html new file mode 100644 index 0000000000..91306be71d --- /dev/null +++ b/dom/html/crashtests/682460.html @@ -0,0 +1,21 @@ +<html> +<head> +<script> + +function boom() +{ + var f = function() { + document.documentElement.offsetHeight; + }; + window.addEventListener("DOMSubtreeModified", f, true); + + document.getElementsByTagName("table")[0].setAttribute("cellpadding", "2"); +} + +</script> +</head> + +<body onload="boom();"> +<table><tr><td></td></tr></table> +</body> +</html> diff --git a/dom/html/crashtests/68912-1.html b/dom/html/crashtests/68912-1.html new file mode 100644 index 0000000000..bdd2ab4614 --- /dev/null +++ b/dom/html/crashtests/68912-1.html @@ -0,0 +1,24 @@ +<html>
+<head>
+<title>Crash TR.cells = null</title>
+<script language="javascript">
+function crashme()
+{
+ var elm = document.createElement('tr');
+
+ elm.cells = null;
+}
+
+</script>
+</head>
+<body onload="crashme()">
+
+<p>
+This test case creates a TR element then tries to assign to the cells property
+</p>
+<p>
+Crash
+</p>
+
+</body>
+</html>
diff --git a/dom/html/crashtests/738744.xhtml b/dom/html/crashtests/738744.xhtml new file mode 100644 index 0000000000..7f91d0149b --- /dev/null +++ b/dom/html/crashtests/738744.xhtml @@ -0,0 +1,4 @@ +<input xmlns="http://www.w3.org/1999/xhtml" form="f"> + <form id="f" /> + <input form="f" /> +</input> diff --git a/dom/html/crashtests/741218.json b/dom/html/crashtests/741218.json new file mode 100644 index 0000000000..0967ef424b --- /dev/null +++ b/dom/html/crashtests/741218.json @@ -0,0 +1 @@ +{} diff --git a/dom/html/crashtests/741218.json^headers^ b/dom/html/crashtests/741218.json^headers^ new file mode 100644 index 0000000000..7b5e82d4b7 --- /dev/null +++ b/dom/html/crashtests/741218.json^headers^ @@ -0,0 +1 @@ +Content-Type: application/json diff --git a/dom/html/crashtests/741250.xhtml b/dom/html/crashtests/741250.xhtml new file mode 100644 index 0000000000..e18a9409fe --- /dev/null +++ b/dom/html/crashtests/741250.xhtml @@ -0,0 +1,9 @@ +<input form="f" id="x" xmlns="http://www.w3.org/1999/xhtml"> +<form id="f"></form> +<script> +window.addEventListener("load", function() { + var x = document.getElementById("x"); + x.appendChild(x.cloneNode(true)); +}, false); +</script> +</input> diff --git a/dom/html/crashtests/768344.html b/dom/html/crashtests/768344.html new file mode 100644 index 0000000000..4830e6674d --- /dev/null +++ b/dom/html/crashtests/768344.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + function f() { + document.removeEventListener("DOMSubtreeModified", f, true); + document.documentElement.setAttributeNS(null, "contenteditable", "false"); + } + + document.addEventListener("DOMSubtreeModified", f, true); + + document.documentElement.contentEditable = "true"; +} + +</script> +</head> + +<body onload="boom();"></body> +</html> diff --git a/dom/html/crashtests/795221-1.html b/dom/html/crashtests/795221-1.html new file mode 100644 index 0000000000..70e400bed9 --- /dev/null +++ b/dom/html/crashtests/795221-1.html @@ -0,0 +1,7 @@ +<!DOCTYPE html> +<style> + div { } +</style> +<script> + document.styleSheets[0].cssRules[0].style.foo = document; +</script> diff --git a/dom/html/crashtests/795221-2.html b/dom/html/crashtests/795221-2.html new file mode 100644 index 0000000000..fc2aa7d506 --- /dev/null +++ b/dom/html/crashtests/795221-2.html @@ -0,0 +1,9 @@ +<!DOCTYPE html> +<style> + @media all { + div { } + } +</style> +<script> + document.styleSheets[0].cssRules[0].cssRules[0].style.foo = document; +</script> diff --git a/dom/html/crashtests/795221-3.html b/dom/html/crashtests/795221-3.html new file mode 100644 index 0000000000..93348af0bd --- /dev/null +++ b/dom/html/crashtests/795221-3.html @@ -0,0 +1,14 @@ +<!DOCTYPE html> +<body> +<script> + // Create the stylesheet via script, so that the parser's preloading doesn't + // make the CSS loader hold on to the sheet we're _not_ trying to form a + // cycle through, thus accidentally avoiding the cycle + var link = document.createElement("link"); + link.setAttribute("rel", "stylesheet"); + link.setAttribute("href", "data:text/css,div { }"); + link.onload = function () { + document.styleSheets[0].cssRules[0].style.foo = document; + } + document.body.appendChild(link); +</script> diff --git a/dom/html/crashtests/795221-4.html b/dom/html/crashtests/795221-4.html new file mode 100644 index 0000000000..476dd34672 --- /dev/null +++ b/dom/html/crashtests/795221-4.html @@ -0,0 +1,9 @@ +<!DOCTYPE html> +<svg> + <style> + div { } + </style> +</svg> +<script> + document.styleSheets[0].cssRules[0].style.foo = document; +</script> diff --git a/dom/html/crashtests/795221-5.xml b/dom/html/crashtests/795221-5.xml new file mode 100644 index 0000000000..286dcff0d4 --- /dev/null +++ b/dom/html/crashtests/795221-5.xml @@ -0,0 +1,6 @@ +<?xml-stylesheet href="data:text/css,div {}"?> +<html xmlns="http://www.w3.org/1999/xhtml"> + <script> + document.styleSheets[0].cssRules[0].style.foo = document; + </script> +</html> diff --git a/dom/html/crashtests/798802-1.html b/dom/html/crashtests/798802-1.html new file mode 100644 index 0000000000..92ab50fd87 --- /dev/null +++ b/dom/html/crashtests/798802-1.html @@ -0,0 +1,18 @@ +<html> + <head> + <script> + onload = function() { + var canvas2d = document.createElement('canvas') + canvas2d.setAttribute('width', 0) + document.body.appendChild(canvas2d) + var ctx2d = canvas2d.getContext('2d') + ctx2d.fillStyle = 'black' + var gl = document.createElement('canvas').getContext('experimental-webgl') + gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA, gl.RGBA, gl.UNSIGNED_BYTE, canvas2d) + ctx2d.fillRect(0, 0, 1, 1) + } + </script> + </head> + <body> + </body> +</html> diff --git a/dom/html/crashtests/811226.html b/dom/html/crashtests/811226.html new file mode 100644 index 0000000000..990ef9af53 --- /dev/null +++ b/dom/html/crashtests/811226.html @@ -0,0 +1,6 @@ +<!DOCTYPE html> +<html> +<body onload="document.getElementById('s').onerror;"> +<span id="s" onerror="0;"></span> +</body> +</html> diff --git a/dom/html/crashtests/819745.html b/dom/html/crashtests/819745.html new file mode 100644 index 0000000000..389e6b8c13 --- /dev/null +++ b/dom/html/crashtests/819745.html @@ -0,0 +1,5 @@ +<!doctype="html"> +<body> +<script> + document.body.onerror = null; +</script> diff --git a/dom/html/crashtests/828180.html b/dom/html/crashtests/828180.html new file mode 100644 index 0000000000..055c8a34ba --- /dev/null +++ b/dom/html/crashtests/828180.html @@ -0,0 +1,5 @@ +<script> +var table = document.createElement("table"); +table.tHead = null; +table.tFoot = null; +</script> diff --git a/dom/html/crashtests/828472.html b/dom/html/crashtests/828472.html new file mode 100644 index 0000000000..59ce4d280b --- /dev/null +++ b/dom/html/crashtests/828472.html @@ -0,0 +1,6 @@ +<!DOCTYPE html> +<html> +<body> +<input type='date' value='2013-01-01'> +</body> +</html> diff --git a/dom/html/crashtests/837033.html b/dom/html/crashtests/837033.html new file mode 100644 index 0000000000..772d24014c --- /dev/null +++ b/dom/html/crashtests/837033.html @@ -0,0 +1,4 @@ +<!DOCTYPE html> +<html> +<body onload="document.createElement('button').validity.x = null;"></body> +</html> diff --git a/dom/html/crashtests/838256-1.html b/dom/html/crashtests/838256-1.html new file mode 100644 index 0000000000..e1cdc588e8 --- /dev/null +++ b/dom/html/crashtests/838256-1.html @@ -0,0 +1,20 @@ +<!DOCTYPE html> +<html lang="en"> +<head> +<meta charset="UTF-8"> +<style> + +::-moz-range-track { + display: none ! important; +} + +::-moz-range-thumb { + display: none ! important; +} + +</style> +</head> +<body> +<input type="range"> +</body> +</html> diff --git a/dom/html/crashtests/862084.html b/dom/html/crashtests/862084.html new file mode 100644 index 0000000000..d6d04f74de --- /dev/null +++ b/dom/html/crashtests/862084.html @@ -0,0 +1,9 @@ +<!doctype html> +<select></select> +<script> +var select = document.getElementsByTagName("select"); +select.item(0); +select[0]; +select.namedItem("x") +select["x"] +</script> diff --git a/dom/html/crashtests/865147.html b/dom/html/crashtests/865147.html new file mode 100644 index 0000000000..841cf8b6d8 --- /dev/null +++ b/dom/html/crashtests/865147.html @@ -0,0 +1,7 @@ +<!doctype html> +<select></select> +<script> +var select = document.getElementsByTagName("select")[0]; +var newOpt = document.createElement("option"); +select.add(newOpt, newOpt); +</script> diff --git a/dom/html/crashtests/877910.html b/dom/html/crashtests/877910.html new file mode 100644 index 0000000000..d454c4478b --- /dev/null +++ b/dom/html/crashtests/877910.html @@ -0,0 +1 @@ +<select><option id="foo"><script>document.querySelector("select").namedItem("foo")</script> diff --git a/dom/html/crashtests/903106.html b/dom/html/crashtests/903106.html new file mode 100644 index 0000000000..fceaf4761a --- /dev/null +++ b/dom/html/crashtests/903106.html @@ -0,0 +1,3 @@ +<script> + document.createElement("tr").sectionRowIndex; +</script> diff --git a/dom/html/crashtests/916322-1.html b/dom/html/crashtests/916322-1.html new file mode 100644 index 0000000000..56b43d6394 --- /dev/null +++ b/dom/html/crashtests/916322-1.html @@ -0,0 +1,10 @@ +<canvas height=16 id=gl> +<script> +// Without the fix, this would trigger an assertion in the debug build +document.addEventListener("DOMContentLoaded", DifferentSizes); +function DifferentSizes() { + gl.getContext("2d"); + gl.removeAttribute('height'); + gl.toBlob(function() { }, false) +} +</script> diff --git a/dom/html/crashtests/916322-2.html b/dom/html/crashtests/916322-2.html new file mode 100644 index 0000000000..c2e5c29205 --- /dev/null +++ b/dom/html/crashtests/916322-2.html @@ -0,0 +1,10 @@ +<canvas height=200 id=gl> +<script> +// Without the fix, this would trigger an assertion in the debug build +document.addEventListener("DOMContentLoaded", DifferentSizes); +function DifferentSizes() { + gl.getContext("2d"); + gl.removeAttribute('height'); + gl.toBlob(function() { }, false) +} +</script> diff --git a/dom/html/crashtests/978644.xhtml b/dom/html/crashtests/978644.xhtml new file mode 100644 index 0000000000..0fd9043a28 --- /dev/null +++ b/dom/html/crashtests/978644.xhtml @@ -0,0 +1,11 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> + +<body onload="document.getElementById('b').appendChild(document.getElementById('v'));"> + +<fieldset><fieldset id="b"></fieldset></fieldset> + +<div id="v"><fieldset><input required="" /><input required="" /></fieldset></div> + +</body> + +</html> diff --git a/dom/html/crashtests/crashtests.list b/dom/html/crashtests/crashtests.list new file mode 100644 index 0000000000..915b00ac5a --- /dev/null +++ b/dom/html/crashtests/crashtests.list @@ -0,0 +1,98 @@ +load 68912-1.html +load 257818-1.html +load 285166-1.html +load 294235-1.html +load 307616-1.html +load 324918-1.xhtml +load 338649-1.xhtml +load 339501-1.xhtml +load 339501-2.xhtml +load 378993-1.xhtml +load 382568-1.html +load 383137.xhtml +load 388183-1.html +load 395340-1.html +load 399694-1.html +load 407053.html +load 423371-1.html +load 448564.html +load 451123-1.html +load 453406-1.html +load 464197-1.html +load 468562-1.html +load 468562-2.html +load 494225.html +load 495543.svg +load 495546-1.html +load 504183-1.html +load 515829-1.html +load 515829-2.html +load 570566-1.html +load 571428-1.html +load 580507-1.xhtml +load 590387.html +load 596785-1.html +load 596785-2.html +load 602117.html +load 604807.html +load 605264.html +load 606430-1.html +load 613027.html +load 614279.html +load 614988-1.html +load 620078-1.html +load 620078-2.html +load 631421.html +load 673853.html +load 682058.xhtml +load 682460.html +load 738744.xhtml +load 741218.json +load 741250.xhtml +load 768344.html +load 795221-1.html +load 795221-2.html +load 795221-3.html +load 795221-4.html +load 795221-5.xml +load 811226.html +load 819745.html +load 828180.html +load 828472.html +load 837033.html +load 838256-1.html +load 862084.html +load 865147.html +load 877910.html +load 903106.html +load 916322-1.html +load 916322-2.html +load 978644.xhtml +load 1032654.html +load 1141260.html +load 1228876.html +load 1230110.html +load 1237633.html +load 1281972-1.html +load 1282894.html +load 1290904.html +load 1343886-1.html +load 1343886-2.xml +load 1343886-3.xml +load 1350972.html +load 1386905.html +asserts(0-4) load 1401726.html +load 1412173.html +load 1440523.html +load 1547057.html +load 1550524.html +load 1550881-1.html +load 1550881-2.html +skip-if(Android) pref(dom.disable_open_during_load,false) load 1667493.html +load 1680418.html +load 1704660.html +load 1724816.html +load 1785933.html +load 1787671.html +load 1789475.html +load 1801380.html |
