diff options
| author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 09:22:09 +0000 |
|---|---|---|
| committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 09:22:09 +0000 |
| commit | 43a97878ce14b72f0981164f87f2e35e14151312 (patch) | |
| tree | 620249daf56c0258faa40cbdcf9cfba06de2a846 /accessible/tests/crashtests | |
| parent | Initial commit. (diff) | |
| download | firefox-upstream.tar.xz firefox-upstream.zip | |
Adding upstream version 110.0.1.upstream/110.0.1upstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'accessible/tests/crashtests')
20 files changed, 343 insertions, 0 deletions
diff --git a/accessible/tests/crashtests/1072792.xhtml b/accessible/tests/crashtests/1072792.xhtml new file mode 100644 index 0000000000..f99c64c5d3 --- /dev/null +++ b/accessible/tests/crashtests/1072792.xhtml @@ -0,0 +1,5 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<body onload="document.body.appendChild(x);"> +<table><tbody><div id="x"></div></tbody></table> +</body> +</html> diff --git a/accessible/tests/crashtests/1380199.html b/accessible/tests/crashtests/1380199.html new file mode 100644 index 0000000000..c690597173 --- /dev/null +++ b/accessible/tests/crashtests/1380199.html @@ -0,0 +1,15 @@ +<script> +window.onload=function(){ + let o=document.getElementById('a'); + let n=document.createElement('plaintext'); + o.parentNode.replaceChild(n,o); + n.setAttribute('id','a'); + document.getElementById('a').setAttribute('aria-owns','c b'); + document.getElementById('d').setAttribute('width',1); +} +</script> +> +<script id='a'></script> +<hgroup id='b'> +<h6 id='c'> +<video id='d' controls width='169' height='187'> diff --git a/accessible/tests/crashtests/1402999.html b/accessible/tests/crashtests/1402999.html new file mode 100644 index 0000000000..567f20b2df --- /dev/null +++ b/accessible/tests/crashtests/1402999.html @@ -0,0 +1,11 @@ +<script> +document.addEventListener("DOMContentLoaded", function(){ + document.getElementById('a').click(); + window.frames[0].document.body.appendChild(document.getElementById('b')); +}); +</script> +<cite id='b'> +<label> +<input/> +<strong id='a'></strong> +<iframe> diff --git a/accessible/tests/crashtests/1415667.html b/accessible/tests/crashtests/1415667.html new file mode 100644 index 0000000000..174099837d --- /dev/null +++ b/accessible/tests/crashtests/1415667.html @@ -0,0 +1 @@ +<iframe role="row"> diff --git a/accessible/tests/crashtests/1463962.html b/accessible/tests/crashtests/1463962.html new file mode 100644 index 0000000000..c3d233af5c --- /dev/null +++ b/accessible/tests/crashtests/1463962.html @@ -0,0 +1,4 @@ +<style> +#a { display: contents } +</style> +<li id="a"> diff --git a/accessible/tests/crashtests/1472024-1.html b/accessible/tests/crashtests/1472024-1.html new file mode 100644 index 0000000000..2b745a635e --- /dev/null +++ b/accessible/tests/crashtests/1472024-1.html @@ -0,0 +1,7 @@ +<style> +.a { position: absolute } +</style> +<table> +<tbody class="a"> +<tr>b</tr> +<th> diff --git a/accessible/tests/crashtests/1472024-2.html b/accessible/tests/crashtests/1472024-2.html new file mode 100644 index 0000000000..74719cb91a --- /dev/null +++ b/accessible/tests/crashtests/1472024-2.html @@ -0,0 +1,20 @@ +<html class="reftest-wait"> +<script> +function tweak() { + document.getElementById('a').appendChild(document.createTextNode('hZ')); + document.documentElement.removeAttribute("class"); +} + +window.onload = () => { + // double-rAF (to ensure layout/paints have been flushed) before we make + // the dynamic modification. This seems to make the bug more likely to + // reproduce, in unpatched builds. + requestAnimationFrame(() => { requestAnimationFrame(() => { + tweak(); + }); }); +}; +</script> +<table> +<tfoot id='a'> +<th> +<textarea>Text diff --git a/accessible/tests/crashtests/1484778.html b/accessible/tests/crashtests/1484778.html new file mode 100644 index 0000000000..9d3fc33f59 --- /dev/null +++ b/accessible/tests/crashtests/1484778.html @@ -0,0 +1,26 @@ +<style> +#a { border-left: solid -moz-hyperlinktext 93em } +</style> +<script> +/* + I dont't know why but this seems to be required to trigger the crash... + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa + aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa +*/ +function go() { + var b = document.elementFromPoint(0,0); + window.scroll({left: 97, top: -1}); + document.adoptNode(b); +} +</script> +<body onload=go()> +<ins id="a"> diff --git a/accessible/tests/crashtests/1494707.html b/accessible/tests/crashtests/1494707.html new file mode 100644 index 0000000000..f2feb1572d --- /dev/null +++ b/accessible/tests/crashtests/1494707.html @@ -0,0 +1,15 @@ +<html>
+ <head>
+ <style>
+ *::after {
+ content: counters(bar, '', none);
+ }
+ </style>
+ </head>
+ <body>
+ <table>
+ <thead></thead>
+ <th></th>
+ </table>
+ </body>
+</html>
diff --git a/accessible/tests/crashtests/1503964.html b/accessible/tests/crashtests/1503964.html new file mode 100644 index 0000000000..bc4c359b52 --- /dev/null +++ b/accessible/tests/crashtests/1503964.html @@ -0,0 +1,4 @@ +<table>
+<th>X</th>
+<tfoot style="display: table-row">
+<tr role="columnheader">X</tr>
diff --git a/accessible/tests/crashtests/1572811.html b/accessible/tests/crashtests/1572811.html new file mode 100644 index 0000000000..61dc78ca7b --- /dev/null +++ b/accessible/tests/crashtests/1572811.html @@ -0,0 +1,9 @@ +<script>
+function go() {
+ a.style.overflow = "auto";
+}
+</script>
+<body onload=go()>
+<table id="a" background="3">
+<th>
+<textarea style="position:absolute">A</textarea>
diff --git a/accessible/tests/crashtests/1578282.html b/accessible/tests/crashtests/1578282.html new file mode 100644 index 0000000000..31cc1ce02b --- /dev/null +++ b/accessible/tests/crashtests/1578282.html @@ -0,0 +1,21 @@ +<html class="reftest-wait"> +<head> +<script> +function onload() { + document.documentElement.style.display = "none" + document.documentElement.getBoundingClientRect() + document.documentElement.style.display = "" + window.setTimeout(() => { + document.documentElement.removeAttribute("class"); + }, 1000); +} +</script> +</head> +<body onload="onload()"> +<marquee style="display: inline-grid"> +<video></video> +<bgsound></bgsound> +< +</marquee> +</body> +</html>
\ No newline at end of file diff --git a/accessible/tests/crashtests/1585851.html b/accessible/tests/crashtests/1585851.html new file mode 100644 index 0000000000..3acac2de7d --- /dev/null +++ b/accessible/tests/crashtests/1585851.html @@ -0,0 +1,21 @@ +<style>
+* {
+ border-collapse: collapse;
+}
+</style>
+<script>
+window.onload = () => {
+ c.style.setProperty("border-collapse", "separate")
+}
+function eh() {
+ a.options.add(f)
+ a.add(b, 9)
+ a.add(f, d)
+}
+</script>
+<select id="a"></select>
+<option id="b">
+<dd id="c">
+<audio id="d" controls>
+<details open="true" ontoggle="eh()">
+<optgroup id="f">
diff --git a/accessible/tests/crashtests/1655983.html b/accessible/tests/crashtests/1655983.html new file mode 100644 index 0000000000..88fee3ec5d --- /dev/null +++ b/accessible/tests/crashtests/1655983.html @@ -0,0 +1,6 @@ +<script> + document.addEventListener('DOMContentLoaded', () => { + document.getElementById('id_0').type = '' + }) +</script> +<input id="id_0" type="time"> diff --git a/accessible/tests/crashtests/448064.xhtml b/accessible/tests/crashtests/448064.xhtml new file mode 100644 index 0000000000..c1a25ca550 --- /dev/null +++ b/accessible/tests/crashtests/448064.xhtml @@ -0,0 +1,70 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +</head> +<body> +<div id="mw_b"> +<div id="mw_f"> +<div id="mw_g" style="display: none;"/> +</div> +</div> + +<div id="mw_c" style="display: none;"> +<div id="mw_d"> +<div id="mw_e"></div> +</div> +</div> + +<input id="mw_a"/> + + +<script> +function dumpAccessibleNode(aNode, level) { + var msg = ""; + + try { + msg += "name=\"" + aNode.name + "\" "; + } catch (e) { + msg += " noName "; + } + + dump(msg + "\n"); +} + + +function dumpAccessibleTree(aNode, level) { + level = level || 0; + + dumpAccessibleNode(aNode, level); + try { + var child = aNode.firstChild; + while (child) { + dumpAccessibleTree(child, level + 1); + child = child.nextSibling; + } + } catch (e) { + dump("Error visiting child nodes: " + e + "\n"); + } +} + +function A(o) { + var acc = SpecialPowers.Cc["@mozilla.org/accessibilityService;1"] + .getService(SpecialPowers.Ci.nsIAccessibilityService); + return acc.getAccessibleFor(o); +} + +function beginAccessible() { + dumpAccessibleTree(A(document), 0); +} +setTimeout(beginAccessible, 100); + + +setTimeout(doe, 200); +function doe() { + document.getElementById("mw_a").appendChild(document.getElementById("mw_b")); + document.getElementById("mw_c").appendChild(document.getElementById("mw_d")); + document.getElementById("mw_e").appendChild(document.getElementById("mw_f")); + document.getElementById("mw_g").appendChild(document.getElementById("mw_b")); +} +</script> +</body> +</html> diff --git a/accessible/tests/crashtests/884202.html b/accessible/tests/crashtests/884202.html new file mode 100644 index 0000000000..f29ef55f4a --- /dev/null +++ b/accessible/tests/crashtests/884202.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html> +<head> +<script> +function f() +{ + window.removeEventListener("pagehide", f, false); + var root = document.documentElement; + document.removeChild(root); + document.appendChild(root); +} + +function boom() +{ + window.addEventListener("pagehide", f, false); + window.location = "data:text/html,4"; +} +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/accessible/tests/crashtests/890760.html b/accessible/tests/crashtests/890760.html new file mode 100644 index 0000000000..ecc76160b9 --- /dev/null +++ b/accessible/tests/crashtests/890760.html @@ -0,0 +1,14 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + window.getSelection().collapse(document.createTextNode("."), 0); +} + +</script> +</head> +<body onload="setTimeout(boom, 0);"></body> +</html> diff --git a/accessible/tests/crashtests/893515.html b/accessible/tests/crashtests/893515.html new file mode 100644 index 0000000000..a9cc12c928 --- /dev/null +++ b/accessible/tests/crashtests/893515.html @@ -0,0 +1,15 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> +function boom() +{ + document.designMode = 'on'; + var otherDoc = document.implementation.createDocument("", "", null); + otherDoc.adoptNode(document.getElementById("t")); +} +</script> +</head> +<body onload="setTimeout(boom, 0);"><textarea id="t"></textarea></body> +</html> diff --git a/accessible/tests/crashtests/crashtests.list b/accessible/tests/crashtests/crashtests.list new file mode 100644 index 0000000000..8c80c1e29a --- /dev/null +++ b/accessible/tests/crashtests/crashtests.list @@ -0,0 +1,22 @@ +load 448064.xhtml # This test instantiates a11y, so be careful about adding tests before it +asserts-if(!browserIsRemote,2) load 884202.html +load 1572811.html +load 1578282.html +load 890760.html +load 893515.html +load 1072792.xhtml +load 1380199.html +load 1402999.html +load 1463962.html +load 1472024-1.html +load 1472024-2.html +load 1484778.html +load 1494707.html +load 1503964.html +load 1415667.html +load 1585851.html +load 1655983.html + +# last_test_to_unload_testsuite.xhtml MUST be the last test in the list because it +# is responsible for shutting down accessibility service affecting later tests. +skip-if(/^Windows\x20NT\x2010\.0/.test(http.oscpu)&&/^aarch64-msvc/.test(xulRuntime.XPCOMABI)) load chrome://reftest/content/crashtests/accessible/tests/crashtests/last_test_to_unload_testsuite.xhtml diff --git a/accessible/tests/crashtests/last_test_to_unload_testsuite.xhtml b/accessible/tests/crashtests/last_test_to_unload_testsuite.xhtml new file mode 100644 index 0000000000..9a70c41dcf --- /dev/null +++ b/accessible/tests/crashtests/last_test_to_unload_testsuite.xhtml @@ -0,0 +1,36 @@ +<?xml version="1.0"?> +<?xml-stylesheet href="chrome://global/skin" type="text/css"?> + +<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" + title="bug 471493 'crash [@ nsPropertyTable::GetPropertyInternal]'" + onload="shutdown();" class="reftest-wait"> + + <script type="application/javascript"> + <![CDATA[ + function shutdown() { + !SpecialPowers.Services.appinfo.accessibilityEnabled && + dump("### Error : Accessibility is expected to be enabled.\n"); + + // Force garbage collection. We try really hard to garbage collect + // everythin here to ensure that all a11y xpcom bits are shut down and + // avoid intermittent timeouts. + SpecialPowers.gc(); + SpecialPowers.forceShrinkingGC(); + SpecialPowers.forceCC(); + SpecialPowers.gc(); + SpecialPowers.forceShrinkingGC(); + SpecialPowers.forceCC(); + + if (SpecialPowers.Services.appinfo.accessibilityEnabled) { + let observe = (subject, topic, data) => { + SpecialPowers.Services.obs.removeObserver(observe, "a11y-init-or-shutdown"); + data === "0" && document.documentElement.removeAttribute("class"); + }; + SpecialPowers.Services.obs.addObserver(observe, "a11y-init-or-shutdown"); + } else { + document.documentElement.removeAttribute("class"); + } + } + ]]> + </script> +</window> |