summaryrefslogtreecommitdiffstats
path: root/dom/workers/test/crashtests
diff options
context:
space:
mode:
Diffstat (limited to 'dom/workers/test/crashtests')
-rw-r--r--dom/workers/test/crashtests/1153636.html5
-rw-r--r--dom/workers/test/crashtests/1158031.html11
-rw-r--r--dom/workers/test/crashtests/1228456.html14
-rw-r--r--dom/workers/test/crashtests/1348882.html18
-rw-r--r--dom/workers/test/crashtests/1819146.html23
-rw-r--r--dom/workers/test/crashtests/1821066.html9
-rw-r--r--dom/workers/test/crashtests/779707.html19
-rw-r--r--dom/workers/test/crashtests/943516.html10
-rw-r--r--dom/workers/test/crashtests/crashtests.list8
9 files changed, 117 insertions, 0 deletions
diff --git a/dom/workers/test/crashtests/1153636.html b/dom/workers/test/crashtests/1153636.html
new file mode 100644
index 0000000000..6ad0d550fd
--- /dev/null
+++ b/dom/workers/test/crashtests/1153636.html
@@ -0,0 +1,5 @@
+<script>
+
+new Worker("data:text/javascript;charset=UTF-8,self.addEventListener('',function(){},false);");
+
+</script>
diff --git a/dom/workers/test/crashtests/1158031.html b/dom/workers/test/crashtests/1158031.html
new file mode 100644
index 0000000000..6d896bc466
--- /dev/null
+++ b/dom/workers/test/crashtests/1158031.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<script>
+
+function boom()
+{
+ var w = new Worker("data:text/javascript;charset=UTF-8,");
+ w.postMessage(new Blob([], {}));
+}
+
+</script>
+<body onload="boom();"></body>
diff --git a/dom/workers/test/crashtests/1228456.html b/dom/workers/test/crashtests/1228456.html
new file mode 100644
index 0000000000..6d1f0f0a72
--- /dev/null
+++ b/dom/workers/test/crashtests/1228456.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<script>
+
+function boom()
+{
+ var w;
+ for (var i = 0; i < 99; ++i) {
+ w = new SharedWorker("data:text/javascript;charset=UTF-8," + encodeURIComponent(i + ";"));
+ }
+ w.port.postMessage("");
+}
+
+</script>
+<body onload="boom();"></body>
diff --git a/dom/workers/test/crashtests/1348882.html b/dom/workers/test/crashtests/1348882.html
new file mode 100644
index 0000000000..e0288c4ccb
--- /dev/null
+++ b/dom/workers/test/crashtests/1348882.html
@@ -0,0 +1,18 @@
+<!DOCTYPE>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+function boom() {
+ let r = new Request("#a#a");
+ setTimeout(function(){
+ r.formData();
+ setTimeout(function(){
+ r.blob();
+ }, 0);
+ }, 0);
+}
+addEventListener("DOMContentLoaded", boom);
+</script>
+</head>
+</html>
diff --git a/dom/workers/test/crashtests/1819146.html b/dom/workers/test/crashtests/1819146.html
new file mode 100644
index 0000000000..611acb3ed2
--- /dev/null
+++ b/dom/workers/test/crashtests/1819146.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <script id="worker1" type="javascript/worker">
+ self.onmessage = async function (e) {
+ const abort = new AbortController()
+ const signal = abort.signal
+ abort.abort()
+ close()
+ try { await fetch(undefined, { signal: signal }) } catch (e) {}
+ await navigator.locks.request("weblock_0", { signal: signal }, () => {})
+ await fetch(undefined, { headers: [] })
+ }
+ </script>
+ <script>
+ document.addEventListener('DOMContentLoaded', () => {
+ const blob = new Blob([document.querySelector('#worker1').textContent], { type: 'text/javascript' })
+ const worker = new Worker(window.URL.createObjectURL(blob))
+ worker.postMessage([], [])
+ })
+ </script>
+</head>
+</html>
diff --git a/dom/workers/test/crashtests/1821066.html b/dom/workers/test/crashtests/1821066.html
new file mode 100644
index 0000000000..d654b37768
--- /dev/null
+++ b/dom/workers/test/crashtests/1821066.html
@@ -0,0 +1,9 @@
+<!DOCTYPE>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+new Worker("data:text/javascript;charset=UTF-8,import { o } from '404.js'", {type: 'module'});
+</script>
+</head>
+</html>
diff --git a/dom/workers/test/crashtests/779707.html b/dom/workers/test/crashtests/779707.html
new file mode 100644
index 0000000000..97a8113dab
--- /dev/null
+++ b/dom/workers/test/crashtests/779707.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var x = new XMLHttpRequest();
+ x.open('GET', "data:text/plain,2", false);
+ x.send();
+
+ new Worker("data:text/javascript,3");
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/workers/test/crashtests/943516.html b/dom/workers/test/crashtests/943516.html
new file mode 100644
index 0000000000..5f4667850f
--- /dev/null
+++ b/dom/workers/test/crashtests/943516.html
@@ -0,0 +1,10 @@
+<!--
+Any copyright is dedicated to the Public Domain.
+http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE html>
+<script>
+// Using a DOM bindings object as a weak map key should not crash when attempting to
+// call the preserve wrapper callback.
+new Worker("data:text/javascript;charset=UTF-8,(new WeakMap()).set(self, 0);")
+</script>
diff --git a/dom/workers/test/crashtests/crashtests.list b/dom/workers/test/crashtests/crashtests.list
new file mode 100644
index 0000000000..528f4c8a10
--- /dev/null
+++ b/dom/workers/test/crashtests/crashtests.list
@@ -0,0 +1,8 @@
+load 779707.html
+load 943516.html
+load 1153636.html
+load 1158031.html
+load 1228456.html
+load 1348882.html
+load 1821066.html
+load 1819146.html