summaryrefslogtreecommitdiffstats
path: root/dom/xslt/crashtests
diff options
context:
space:
mode:
Diffstat (limited to 'dom/xslt/crashtests')
-rw-r--r--dom/xslt/crashtests/1089049.html3
-rw-r--r--dom/xslt/crashtests/111994.xml5
-rw-r--r--dom/xslt/crashtests/111994.xsl13
-rw-r--r--dom/xslt/crashtests/1205163.xml6
-rw-r--r--dom/xslt/crashtests/1205163.xsl11
-rw-r--r--dom/xslt/crashtests/1243337.xml3
-rw-r--r--dom/xslt/crashtests/1243337.xsl6
-rw-r--r--dom/xslt/crashtests/1330492.html23
-rw-r--r--dom/xslt/crashtests/1336828.html22
-rw-r--r--dom/xslt/crashtests/1336830.html27
-rw-r--r--dom/xslt/crashtests/1336832.html28
-rw-r--r--dom/xslt/crashtests/1338277.html21
-rw-r--r--dom/xslt/crashtests/1361892.html23
-rw-r--r--dom/xslt/crashtests/1430818.sjs49
-rw-r--r--dom/xslt/crashtests/1430818.xml4
-rw-r--r--dom/xslt/crashtests/1527277.html14
-rw-r--r--dom/xslt/crashtests/1589930.xml10
-rw-r--r--dom/xslt/crashtests/182460-select.xml3
-rw-r--r--dom/xslt/crashtests/182460-selects.xsl5
-rw-r--r--dom/xslt/crashtests/182460-table.xhtml9
-rw-r--r--dom/xslt/crashtests/226425.xml4
-rw-r--r--dom/xslt/crashtests/226425.xsl10
-rw-r--r--dom/xslt/crashtests/406106-1.html18
-rw-r--r--dom/xslt/crashtests/483444.xml19
-rw-r--r--dom/xslt/crashtests/485217.xml8
-rw-r--r--dom/xslt/crashtests/485217.xsl18
-rw-r--r--dom/xslt/crashtests/485286.xml12
-rw-r--r--dom/xslt/crashtests/527558_1.xml17
-rw-r--r--dom/xslt/crashtests/528300.xml22
-rw-r--r--dom/xslt/crashtests/528488.xml19
-rw-r--r--dom/xslt/crashtests/528963.xml22
-rw-r--r--dom/xslt/crashtests/545927.html28
-rw-r--r--dom/xslt/crashtests/601543.html4
-rw-r--r--dom/xslt/crashtests/602115.html22
-rw-r--r--dom/xslt/crashtests/603844.html32
-rw-r--r--dom/xslt/crashtests/667315.xml11
-rw-r--r--dom/xslt/crashtests/91332.xml10
-rw-r--r--dom/xslt/crashtests/91332.xsl21
-rw-r--r--dom/xslt/crashtests/949990.html15
-rw-r--r--dom/xslt/crashtests/crashtests.list30
40 files changed, 627 insertions, 0 deletions
diff --git a/dom/xslt/crashtests/1089049.html b/dom/xslt/crashtests/1089049.html
new file mode 100644
index 0000000000..84ef6494c3
--- /dev/null
+++ b/dom/xslt/crashtests/1089049.html
@@ -0,0 +1,3 @@
+<script>
+var xpathResult = document.evaluate('', null, null, XPathResult.FIRST_ORDERED_NODE_TYPE, null);
+</script>
diff --git a/dom/xslt/crashtests/111994.xml b/dom/xslt/crashtests/111994.xml
new file mode 100644
index 0000000000..ce7ffad2ac
--- /dev/null
+++ b/dom/xslt/crashtests/111994.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" standalone="yes" ?>
+<?xml-stylesheet type="text/xsl" href="111994.xsl" ?>
+<root>
+ <item id="1001" name="name" />
+</root>
diff --git a/dom/xslt/crashtests/111994.xsl b/dom/xslt/crashtests/111994.xsl
new file mode 100644
index 0000000000..4cf68179fa
--- /dev/null
+++ b/dom/xslt/crashtests/111994.xsl
@@ -0,0 +1,13 @@
+<?xml version="1.0" ?>
+<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
+ <xsl:template match="root">
+ <html><body><xsl:apply-templates select="item" /></body></html>
+ </xsl:template>
+ <xsl:template match="item">
+ <img>
+ <xsl:attribute name="src">
+ <xsl:value-of select="@name" />
+ </xsl:attribute>
+ </img>
+ </xsl:template>
+</xsl:stylesheet>
diff --git a/dom/xslt/crashtests/1205163.xml b/dom/xslt/crashtests/1205163.xml
new file mode 100644
index 0000000000..2d450a1d50
--- /dev/null
+++ b/dom/xslt/crashtests/1205163.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xsl" href="1205163.xsl"?>
+<result>
+ <Title>Example</Title>
+ <Error>Error</Error>
+</result>
diff --git a/dom/xslt/crashtests/1205163.xsl b/dom/xslt/crashtests/1205163.xsl
new file mode 100644
index 0000000000..f0bbb5cb95
--- /dev/null
+++ b/dom/xslt/crashtests/1205163.xsl
@@ -0,0 +1,11 @@
+<?xml version="1.0"?>
+<xsl:stylesheet version="1.0"
+ xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+ <xsl:output method="text"/>
+ <xsl:template match="node()|@*">
+ <xsl:copy>
+ <xsl:apply-templates select="node()|@*"/>
+ </xsl:copy>
+ </xsl:template>
+ <xsl:template match="Error"/>
+</xsl:stylesheet>
diff --git a/dom/xslt/crashtests/1243337.xml b/dom/xslt/crashtests/1243337.xml
new file mode 100644
index 0000000000..40f5e3a35d
--- /dev/null
+++ b/dom/xslt/crashtests/1243337.xml
@@ -0,0 +1,3 @@
+<?xml version="1.0" standalone="yes" ?>
+<?xml-stylesheet type="text/xsl" href="1243337.xsl" ?>
+<root/>
diff --git a/dom/xslt/crashtests/1243337.xsl b/dom/xslt/crashtests/1243337.xsl
new file mode 100644
index 0000000000..0e659bf900
--- /dev/null
+++ b/dom/xslt/crashtests/1243337.xsl
@@ -0,0 +1,6 @@
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+ <xsl:template match="/">
+ <xsl:value-of select="generate-id(5)"/>
+ <html><body/></html>
+ </xsl:template>
+</xsl:stylesheet>
diff --git a/dom/xslt/crashtests/1330492.html b/dom/xslt/crashtests/1330492.html
new file mode 100644
index 0000000000..a19c646a17
--- /dev/null
+++ b/dom/xslt/crashtests/1330492.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<meta charset="UTF-8">
+<script id=o_xml type="text/plain"><?xml version="1.0" encoding="UTF-8"?>
+<ffsy></ffsy>
+</script>
+<script id=o_xslt type="text/plain"><?xml version="1.0" encoding="UTF-8"?>
+<xsl:transform xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
+ <xsl:output method="text" />
+</xsl:transform>
+</script>
+<script>
+addEventListener("DOMContentLoaded", function(){
+ let doc = new DOMParser();
+ let xml = doc.parseFromString(o_xml.textContent, "text/xml");
+ let xsltPrs = new XSLTProcessor();
+ let xsl = doc.parseFromString(o_xslt.textContent, "text/xml");
+ xsltPrs.importStylesheet(xsl);
+ xsltPrs.transformToFragment(xml, document);
+ xsltPrs.transformToDocument(xml);
+});
+</script>
+</html>
diff --git a/dom/xslt/crashtests/1336828.html b/dom/xslt/crashtests/1336828.html
new file mode 100644
index 0000000000..3f25e23e03
--- /dev/null
+++ b/dom/xslt/crashtests/1336828.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script id=o_xml type="text/plain"><?xml version="1.0" encoding="UTF-8"?>
+<tag_name/>
+</script>
+<script id=o_xslt type="text/plain"><?xml version="1.0" encoding="UTF-8"?>
+<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="42">
+ <xsl:variable name="var_name"><xsl:template/></xsl:variable>
+ <xsl:template match="tag_name[$var_name]"/>
+</xsl:stylesheet>
+</script>
+<script>
+window.onload = function(){
+ let doc = new DOMParser(), proc = new XSLTProcessor();
+ proc.importStylesheet(doc.parseFromString(document.getElementById('o_xslt').textContent, "text/xml"));
+ proc.transformToDocument(doc.parseFromString(document.getElementById('o_xml').textContent, "text/xml"));
+};
+</script>
+</head>
+</html>
diff --git a/dom/xslt/crashtests/1336830.html b/dom/xslt/crashtests/1336830.html
new file mode 100644
index 0000000000..907f589563
--- /dev/null
+++ b/dom/xslt/crashtests/1336830.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script id=o_xml type="text/plain"><?xml version="1.0" encoding="UTF-8"?>
+<tag_name/>
+</script>
+<script id=o_xslt type="text/plain"><?xml version="1.0" encoding="UTF-8"?>
+<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="42">
+ <xsl:template match="*">
+ <xsl:apply-imports/>
+ <xsl:apply-templates select=".">
+ <xsl:with-param name="whatever_1">whatever_2</xsl:with-param>
+ </xsl:apply-templates>
+ </xsl:template>
+</xsl:stylesheet>
+</script>
+<script>
+window.onload = function(){
+ setTimeout(function(){ window.close(); }, 400);
+ let doc = new DOMParser(), proc = new XSLTProcessor();
+ proc.importStylesheet(doc.parseFromString(document.getElementById('o_xslt').textContent, "text/xml"));
+ proc.transformToFragment(doc.parseFromString(document.getElementById('o_xml').textContent, "text/xml"), document);
+};
+</script>
+</head>
+</html>
diff --git a/dom/xslt/crashtests/1336832.html b/dom/xslt/crashtests/1336832.html
new file mode 100644
index 0000000000..0fb9033d1a
--- /dev/null
+++ b/dom/xslt/crashtests/1336832.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script id=o_xml type="text/plain"><?xml version="1.0" encoding="UTF-8"?>
+<tag_name/>
+</script>
+<script id=o_xslt type="text/plain"><?xml version="1.0" encoding="UTF-8"?>
+<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
+ <xsl:variable name="var_1">
+ <xsl:for-each select="/">
+ <xsl:value-of select="count()"/>
+ </xsl:for-each>
+ </xsl:variable>
+ <xsl:template match="/">
+ <xsl:value-of select="//*[1 = $var_1]"/>
+ </xsl:template>
+</xsl:stylesheet>
+</script>
+<script>
+window.onload = function(){
+ let doc = new DOMParser(), proc = new XSLTProcessor();
+ proc.importStylesheet(doc.parseFromString(document.getElementById('o_xslt').textContent, "text/xml"));
+ proc.transformToDocument(doc.parseFromString(document.getElementById('o_xml').textContent, "text/xml"));
+};
+</script>
+</head>
+</html>
diff --git a/dom/xslt/crashtests/1338277.html b/dom/xslt/crashtests/1338277.html
new file mode 100644
index 0000000000..d928819c75
--- /dev/null
+++ b/dom/xslt/crashtests/1338277.html
@@ -0,0 +1,21 @@
+<script id=o_xml type="text/plain"><?xml version="1.0" encoding="UTF-8"?>
+<xb></xb>
+</script>
+<script id=o_xslt type="text/plain"><?xml version="1.0" encoding="UTF-8"?>
+<xsl:transform version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+ <xsl:template match="xb[$v1]"></xsl:template>
+ <xsl:variable name="v1">
+ <xsl:attribute name="a1" namespace="z">
+ <xsl:variable name="v2" select="$v2"></xsl:variable>
+ </xsl:attribute>
+ </xsl:variable>
+</xsl:transform>
+</script>
+<script>
+addEventListener("DOMContentLoaded", function(){
+ let doc = new DOMParser();
+ let xsltPrs = new XSLTProcessor();
+ xsltPrs.importStylesheet(doc.parseFromString(o_xslt.textContent, "text/xml"));
+ xsltPrs.transformToDocument(doc.parseFromString(o_xml.textContent, "text/xml"));
+});
+</script>
diff --git a/dom/xslt/crashtests/1361892.html b/dom/xslt/crashtests/1361892.html
new file mode 100644
index 0000000000..a7befd2c42
--- /dev/null
+++ b/dom/xslt/crashtests/1361892.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <meta charset="UTF-8">
+ <script id=o_xml type="text/plain"><?xml version="1.0" encoding="UTF-8"?>
+<tag_name/>
+ </script>
+ <script id=o_xslt type="text/plain"><?xml version="1.0" encoding="UTF-8"?>
+<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="42">
+ <xsl:template match="*">
+ <xsl:value-of xmlns:regexp="http://exslt.org/regular-expressions" select="regexp:match('foo','bar','-2')"/>
+ </xsl:template>
+</xsl:stylesheet>
+ </script>
+ <script>
+window.onload = function(){
+ let doc = new DOMParser(), proc = new XSLTProcessor();
+ proc.importStylesheet(doc.parseFromString(document.getElementById('o_xslt').textContent, "text/xml"));
+ proc.transformToDocument(doc.parseFromString(document.getElementById('o_xml').textContent, "text/xml"));
+};
+ </script>
+ </head>
+</html>
diff --git a/dom/xslt/crashtests/1430818.sjs b/dom/xslt/crashtests/1430818.sjs
new file mode 100644
index 0000000000..a1c9f1e662
--- /dev/null
+++ b/dom/xslt/crashtests/1430818.sjs
@@ -0,0 +1,49 @@
+function getFileStream(filename)
+{
+ let self = Components.classes["@mozilla.org/file/local;1"]
+ .createInstance(Components.interfaces.nsIFile);
+ self.initWithPath(getState("__LOCATION__"));
+ let file = self.parent;
+ file.append(filename);
+ let stream = Components.classes['@mozilla.org/network/file-input-stream;1']
+ .createInstance(Components.interfaces.nsIFileInputStream);
+ stream.init(file, -1, -1, false);
+ return stream;
+}
+
+function handleRequest(request, response)
+{
+ response.processAsync();
+ response.setStatusLine(null, 200, "OK");
+ response.setHeader("Content-Type", "text/xml", false);
+
+ switch (request.queryString) {
+ case "stylesheet":
+ {
+ let timer = Components.classes["@mozilla.org/timer;1"]
+ .createInstance(Components.interfaces.nsITimer);
+ timer.initWithCallback(() => {
+ setState("xslt", "loaded");
+ response.finish();
+ timer.cancel();
+ }, 1000 /* milliseconds */, Components.interfaces.nsITimer.TYPE_REPEATING_SLACK);
+ break;
+ }
+ default:
+ {
+ let stream = getFileStream("1430818.xml");
+ response.bodyOutputStream.writeFrom(stream,
+ stream.available());
+ stream.close();
+ let timer = Components.classes["@mozilla.org/timer;1"]
+ .createInstance(Components.interfaces.nsITimer);
+ timer.initWithCallback(() => {
+ if (getState("xslt") == "loaded") {
+ response.finish();
+ timer.cancel();
+ }
+ }, 100 /* milliseconds */, Components.interfaces.nsITimer.TYPE_REPEATING_SLACK);
+ break;
+ }
+ }
+}
diff --git a/dom/xslt/crashtests/1430818.xml b/dom/xslt/crashtests/1430818.xml
new file mode 100644
index 0000000000..95731bcb0b
--- /dev/null
+++ b/dom/xslt/crashtests/1430818.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xsl" href="?stylesheet"?>
+<root>
+</root>
diff --git a/dom/xslt/crashtests/1527277.html b/dom/xslt/crashtests/1527277.html
new file mode 100644
index 0000000000..ef437803c9
--- /dev/null
+++ b/dom/xslt/crashtests/1527277.html
@@ -0,0 +1,14 @@
+<html>
+<script>
+var xml = "<e/>";
+var xsl = "<xsl:stylesheet version=\"1.0\" xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\"><xsl:decimal-format grouping-separator=\".\" /><xsl:template match=\"/\"><xsl:value-of select=\"format-number(0.1, '.#')\"/></xsl:template></xsl:stylesheet>";
+
+var parser = new DOMParser();
+var xmlDoc = parser.parseFromString(xml, "text/xml");
+var xslDoc = parser.parseFromString(xsl, "text/xml");
+
+xsltProcessor = new XSLTProcessor();
+xsltProcessor.importStylesheet(xslDoc);
+var result = xsltProcessor.transformToDocument(xmlDoc);
+</script>
+</html>
diff --git a/dom/xslt/crashtests/1589930.xml b/dom/xslt/crashtests/1589930.xml
new file mode 100644
index 0000000000..74d4cc8463
--- /dev/null
+++ b/dom/xslt/crashtests/1589930.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xsl" href="#stylesheet"?>
+<!DOCTYPE root [
+ <!ATTLIST xsl:stylesheet id ID #IMPLIED>
+]>
+<root>
+<xsl:stylesheet id="stylesheet" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
+ <xsl:template match="/"><xsl:value-of select="format-number(99.98, '0.0')"/></xsl:template>
+</xsl:stylesheet>
+</root>
diff --git a/dom/xslt/crashtests/182460-select.xml b/dom/xslt/crashtests/182460-select.xml
new file mode 100644
index 0000000000..bb9f79b040
--- /dev/null
+++ b/dom/xslt/crashtests/182460-select.xml
@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<?xml-stylesheet type="text/xsl" href="182460-selects.xsl"?>
+<fud/> \ No newline at end of file
diff --git a/dom/xslt/crashtests/182460-selects.xsl b/dom/xslt/crashtests/182460-selects.xsl
new file mode 100644
index 0000000000..f083ea31fe
--- /dev/null
+++ b/dom/xslt/crashtests/182460-selects.xsl
@@ -0,0 +1,5 @@
+<html>
+<body>
+hi
+</body>
+</html>
diff --git a/dom/xslt/crashtests/182460-table.xhtml b/dom/xslt/crashtests/182460-table.xhtml
new file mode 100644
index 0000000000..1bf2a23cb4
--- /dev/null
+++ b/dom/xslt/crashtests/182460-table.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title>XSL Crash</title>
+</head>
+<body>
+<iframe src="182460-select.xml"></iframe>
+<script type="text/javascript" src="data:text/javascript,/*no code*/"/>
+</body>
+</html>
diff --git a/dom/xslt/crashtests/226425.xml b/dom/xslt/crashtests/226425.xml
new file mode 100644
index 0000000000..c6662cfe2c
--- /dev/null
+++ b/dom/xslt/crashtests/226425.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<?xml-stylesheet type="text/xsl" href="226425.xsl" ?>
+
+<text></text>
diff --git a/dom/xslt/crashtests/226425.xsl b/dom/xslt/crashtests/226425.xsl
new file mode 100644
index 0000000000..ddb61ae680
--- /dev/null
+++ b/dom/xslt/crashtests/226425.xsl
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+<xsl:output method="html" indent="yes"/>
+
+<xsl:template match="/">
+<html><body>
+<xsl:apply-templates select="document('dontmatter')"/>
+</body></html>
+</xsl:template>
+</xsl:stylesheet>
diff --git a/dom/xslt/crashtests/406106-1.html b/dom/xslt/crashtests/406106-1.html
new file mode 100644
index 0000000000..86ab510ff8
--- /dev/null
+++ b/dom/xslt/crashtests/406106-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ var p = new XSLTProcessor();
+ p.setParameter("a", "b", {e: p});
+}
+
+boom();
+
+</script>
+</head>
+<body>
+</body>
+</html>
diff --git a/dom/xslt/crashtests/483444.xml b/dom/xslt/crashtests/483444.xml
new file mode 100644
index 0000000000..18fffceba5
--- /dev/null
+++ b/dom/xslt/crashtests/483444.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xsl" href="#stylesheet"?>
+<!DOCTYPE root [
+ <!ATTLIST xsl:stylesheet id ID #IMPLIED>
+]>
+<root>
+<xsl:stylesheet id="stylesheet" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
+ <xsl:attribute-set name="a">
+ <xsl:attribute name="b">c</xsl:attribute>
+ </xsl:attribute-set>
+ <xsl:template match="/">
+ <b>Please output something!</b>
+ </xsl:template>
+ <xsl:attribute-set name="a">
+ <xsl:attribute name="b">c</xsl:attribute>
+ </xsl:attribute-set>
+</xsl:stylesheet>
+<doc id="foo">this</doc>
+</root>
diff --git a/dom/xslt/crashtests/485217.xml b/dom/xslt/crashtests/485217.xml
new file mode 100644
index 0000000000..93a20e4f77
--- /dev/null
+++ b/dom/xslt/crashtests/485217.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<?xml-stylesheet type="text/xsl" href="485217.xsl"?>
+
+
+<root xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+ <item1 id="AAAAAAA" />
+ <item2 id="AAAAAAAAA" label="AAAAAAAAAAAA"/>
+</root>
diff --git a/dom/xslt/crashtests/485217.xsl b/dom/xslt/crashtests/485217.xsl
new file mode 100644
index 0000000000..2935c5a41b
--- /dev/null
+++ b/dom/xslt/crashtests/485217.xsl
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<xsl:stylesheet version="2.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+
+ <xsl:key name="label" match="item2" use="undeclaredfunc()"/>
+
+ <xsl:template match="root">
+ <xsl:for-each select="//item1">
+ <xsl:call-template name="item1" />
+ </xsl:for-each>
+ </xsl:template>
+
+ <xsl:template name="item1">
+ <xsl:for-each select="key('label', 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA')">
+ </xsl:for-each>
+ </xsl:template>
+
+</xsl:stylesheet>
diff --git a/dom/xslt/crashtests/485286.xml b/dom/xslt/crashtests/485286.xml
new file mode 100644
index 0000000000..c87aa940ef
--- /dev/null
+++ b/dom/xslt/crashtests/485286.xml
@@ -0,0 +1,12 @@
+<?xml-stylesheet type="application/xml" href="485286.xml"?>
+<transform xmlns="http://www.w3.org/1999/XSL/Transform" version="1.0">
+ <variable name="v">
+ <for-each select="/">
+ <value-of select="count(1)"/>
+ </for-each>
+ </variable>
+ <key name="k" match="/" use="$v"/>
+ <template match="/">
+ <value-of select="key('k', /..)"/>
+ </template>
+</transform>
diff --git a/dom/xslt/crashtests/527558_1.xml b/dom/xslt/crashtests/527558_1.xml
new file mode 100644
index 0000000000..ebb6c3d533
--- /dev/null
+++ b/dom/xslt/crashtests/527558_1.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xml" href="#bug"?>
+<!DOCTYPE doc [
+<!ATTLIST xsl:transform
+ id ID #REQUIRED>
+]>
+<doc>
+<xsl:transform id="bug"
+ version="2.0"
+ xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+ <xsl:key name="k0" match="e1" use="key('k0', 'foobar')" />
+ <xsl:template id="t1" name="t1" match="key('k0', '1/2/2003')" />
+</xsl:transform>
+
+<e1 a1="foobar" a2="foobar"/>
+
+</doc>
diff --git a/dom/xslt/crashtests/528300.xml b/dom/xslt/crashtests/528300.xml
new file mode 100644
index 0000000000..8902bb373e
--- /dev/null
+++ b/dom/xslt/crashtests/528300.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xml" href="#bug"?>
+<!DOCTYPE doc [
+<!ATTLIST xsl:transform
+ id ID #REQUIRED>
+]>
+<doc>
+<xsl:transform
+ xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+ version="2.0"
+ id="bug">
+ <xsl:variable name="v0">
+ <xsl:for-each select="$v0" />
+ </xsl:variable>
+ <xsl:template name="t2" match="/">
+ <xsl:copy-of select="number($v0)" />
+ </xsl:template>
+</xsl:transform>
+
+<e1 />
+
+</doc>
diff --git a/dom/xslt/crashtests/528488.xml b/dom/xslt/crashtests/528488.xml
new file mode 100644
index 0000000000..904b345612
--- /dev/null
+++ b/dom/xslt/crashtests/528488.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xml" href="#bug"?>
+<!DOCTYPE doc [
+<!ATTLIST xsl:transform
+ id ID #REQUIRED>
+]>
+<doc>
+ <xsl:transform
+ xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+ xmlns:exslstrings="http://exslt.org/strings"
+ version="2.0"
+ id="bug">
+ <xsl:variable name="v0" select="$v0" />
+ <xsl:template name="t2" match="/">
+ <xsl:param name="p0" select="exslstrings:tokenize('1234','foobar')" />
+ <xsl:copy-of select="round($v0)" />
+ </xsl:template>
+ </xsl:transform>
+</doc>
diff --git a/dom/xslt/crashtests/528963.xml b/dom/xslt/crashtests/528963.xml
new file mode 100644
index 0000000000..d855e75634
--- /dev/null
+++ b/dom/xslt/crashtests/528963.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xml" href="#bug"?>
+<!DOCTYPE doc [
+<!ATTLIST xsl:transform
+ id ID #REQUIRED>
+]>
+<doc>
+ <xsl:transform
+ xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+ version="2.0"
+ id="bug">
+ <xsl:key name="k0" match="e2" use="name('foo')" />
+
+ <xsl:template name="t1" match="/">
+ <xsl:element name="e2" namespace="{//doc}" />
+ </xsl:template>
+ <xsl:template name="t2" match="key('k0', 'bar')" />
+ </xsl:transform>
+
+ <e2/>
+
+</doc>
diff --git a/dom/xslt/crashtests/545927.html b/dom/xslt/crashtests/545927.html
new file mode 100644
index 0000000000..0a9010e21e
--- /dev/null
+++ b/dom/xslt/crashtests/545927.html
@@ -0,0 +1,28 @@
+<html>
+<head>
+<script>
+function main()
+{
+ xml=document.implementation.createDocument('', '', null);
+ xml.appendChild(doc=xml.createElement('root'));
+
+ var p = new DOMParser();
+ text = '<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">';
+ text += '<xsl:template match="/">';
+ text += '<body>';
+ text += '<xsl:number value="2147483648" format="i"/>';
+ text += '</body>';
+ text += '</xsl:template>';
+ text += '</xsl:stylesheet>';
+ xsl=p.parseFromString(text, 'text/xml');
+
+ xsltProcessor=new XSLTProcessor();
+ xsltProcessor.importStylesheet(xsl);
+ d = xsltProcessor.transformToFragment(xml, document);
+}
+</script>
+</head>
+<body onload="main()">
+</body>
+</html>
+
diff --git a/dom/xslt/crashtests/601543.html b/dom/xslt/crashtests/601543.html
new file mode 100644
index 0000000000..af025b242a
--- /dev/null
+++ b/dom/xslt/crashtests/601543.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+(new XSLTProcessor).setParameter('', '', [{}, null]);
+</script>
diff --git a/dom/xslt/crashtests/602115.html b/dom/xslt/crashtests/602115.html
new file mode 100644
index 0000000000..ad42d76a05
--- /dev/null
+++ b/dom/xslt/crashtests/602115.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<script>
+
+try {
+ var docType = document.implementation.createDocumentType(undefined, '', '');
+ var doc = document.implementation.createDocument('', '', null);
+ var xp = new XSLTProcessor;
+ xp.importStylesheet(doc);
+ xp.transformToDocument(docType);
+}
+catch (ex) {}
+
+try {
+ docType = document.implementation.createDocumentType(undefined, '', '');
+ doc = document.implementation.createDocument('', '', null);
+ xp = new XSLTProcessor;
+ xp.importStylesheet(doc);
+ xp.transformToFragment(docType, document);
+}
+catch (ex) {}
+
+</script>
diff --git a/dom/xslt/crashtests/603844.html b/dom/xslt/crashtests/603844.html
new file mode 100644
index 0000000000..f576effdb6
--- /dev/null
+++ b/dom/xslt/crashtests/603844.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+ var frame = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
+ frame.onload = y;
+ frame.src = "data:text/plain,0";
+ document.body.appendChild(frame);
+ frameDoc = frame.contentDocument;
+
+ function y()
+ {
+ frameDoc.removeChild(frameDoc.documentElement);
+
+ var xp = new XSLTProcessor;
+ xp.importStylesheet(frameDoc);
+ try {
+ xp.transformToDocument(frameDoc.createTextNode('x'));
+ } catch(e) { }
+
+ document.documentElement.removeAttribute("class");
+ }
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/xslt/crashtests/667315.xml b/dom/xslt/crashtests/667315.xml
new file mode 100644
index 0000000000..7a560ba3bd
--- /dev/null
+++ b/dom/xslt/crashtests/667315.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xsl" href="#stylesheet"?>
+<!DOCTYPE root [
+ <!ATTLIST xsl:stylesheet id ID #IMPLIED>
+]>
+<root>
+<xsl:stylesheet id="stylesheet" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
+ <xsl:variable name="var"><p>a</p></xsl:variable>
+ <xsl:template match="/"><xsl:copy-of select="$var" /></xsl:template>
+</xsl:stylesheet>
+</root>
diff --git a/dom/xslt/crashtests/91332.xml b/dom/xslt/crashtests/91332.xml
new file mode 100644
index 0000000000..c5a463c8a9
--- /dev/null
+++ b/dom/xslt/crashtests/91332.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" standalone="yes" ?>
+<?xml-stylesheet type="text/xsl" href="91332.xsl" ?>
+<root>
+ <category name="Rectangles">
+ <list item="square" />
+ </category>
+ <quad id="square">
+ <desc>A square is ...</desc>
+ </quad>
+</root>
diff --git a/dom/xslt/crashtests/91332.xsl b/dom/xslt/crashtests/91332.xsl
new file mode 100644
index 0000000000..7d01df22b6
--- /dev/null
+++ b/dom/xslt/crashtests/91332.xsl
@@ -0,0 +1,21 @@
+<?xml version="1.0" ?>
+<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
+
+ <xsl:key name="polyList" match="quad" use="@id" />
+
+ <xsl:template match="root">
+ <html><body><xsl:apply-templates select="category" /></body></html>
+ </xsl:template>
+
+ <xsl:template match="category">
+ <table><xsl:apply-templates select="list" /></table>
+ </xsl:template>
+
+ <xsl:template match="list">
+ <tr><td><xsl:apply-templates select="key('polyList',@item)" /></td></tr>
+ </xsl:template>
+
+ <xsl:template match="quad">
+ <b>Please output something!</b>
+ </xsl:template>
+</xsl:stylesheet>
diff --git a/dom/xslt/crashtests/949990.html b/dom/xslt/crashtests/949990.html
new file mode 100644
index 0000000000..23868e4db3
--- /dev/null
+++ b/dom/xslt/crashtests/949990.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom() {
+ document.evaluate("a", document.documentElement, null, 4096, null);
+}
+
+</script>
+</head>
+
+<body onload="boom()"></body>
+</html>
diff --git a/dom/xslt/crashtests/crashtests.list b/dom/xslt/crashtests/crashtests.list
new file mode 100644
index 0000000000..711f357862
--- /dev/null
+++ b/dom/xslt/crashtests/crashtests.list
@@ -0,0 +1,30 @@
+load 91332.xml
+load 111994.xml
+load 182460-table.xhtml
+load 226425.xml
+load 406106-1.html
+load 483444.xml
+load 485217.xml
+load 485286.xml
+load 527558_1.xml
+load 528300.xml
+load 528488.xml
+load 528963.xml
+load 545927.html
+load 601543.html
+load 602115.html
+load 603844.html
+load 667315.xml
+load 949990.html
+load 1089049.html
+load 1205163.xml
+load 1243337.xml
+load 1330492.html
+load 1336828.html
+load 1336830.html
+load 1336832.html
+load 1338277.html
+load 1361892.html
+load 1527277.html
+load 1589930.xml
+HTTP load 1430818.sjs