summaryrefslogtreecommitdiffstats
path: root/dom/xml/crashtests
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-07 09:22:09 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-07 09:22:09 +0000
commit43a97878ce14b72f0981164f87f2e35e14151312 (patch)
tree620249daf56c0258faa40cbdcf9cfba06de2a846 /dom/xml/crashtests
parentInitial commit. (diff)
downloadfirefox-43a97878ce14b72f0981164f87f2e35e14151312.tar.xz
firefox-43a97878ce14b72f0981164f87f2e35e14151312.zip
Adding upstream version 110.0.1.upstream/110.0.1upstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'dom/xml/crashtests')
-rw-r--r--dom/xml/crashtests/1038887.xhtml1
-rw-r--r--dom/xml/crashtests/136896-1.xml62
-rw-r--r--dom/xml/crashtests/1405878.xml11
-rw-r--r--dom/xml/crashtests/1523655.xml3
-rw-r--r--dom/xml/crashtests/185285-1.xml2
-rw-r--r--dom/xml/crashtests/382636-1.xml9
-rw-r--r--dom/xml/crashtests/382636-2.svg5
-rw-r--r--dom/xml/crashtests/382636-3.xhtml9
-rw-r--r--dom/xml/crashtests/382636-4.xhtml5
-rw-r--r--dom/xml/crashtests/420429.xhtml18
-rw-r--r--dom/xml/crashtests/431703-1.xhtml17
-rw-r--r--dom/xml/crashtests/453278-frame.xml3
-rw-r--r--dom/xml/crashtests/453278.html9
-rw-r--r--dom/xml/crashtests/803586.xhtml8
-rw-r--r--dom/xml/crashtests/994740-1.xhtml15
-rw-r--r--dom/xml/crashtests/crashtests.list14
-rw-r--r--dom/xml/crashtests/tree.gifbin0 -> 1140 bytes
17 files changed, 191 insertions, 0 deletions
diff --git a/dom/xml/crashtests/1038887.xhtml b/dom/xml/crashtests/1038887.xhtml
new file mode 100644
index 0000000000..18b12083a9
--- /dev/null
+++ b/dom/xml/crashtests/1038887.xhtml
@@ -0,0 +1 @@
+<?xml-stylesheet type="text/xsl" href="http://notexistingurl"?><html xmlns="http://www.w3.org/1999/xhtml"></html>
diff --git a/dom/xml/crashtests/136896-1.xml b/dom/xml/crashtests/136896-1.xml
new file mode 100644
index 0000000000..a54f95393f
--- /dev/null
+++ b/dom/xml/crashtests/136896-1.xml
@@ -0,0 +1,62 @@
+<?xml version="1.0" standalone="yes"?>
+<!DOCTYPE SITES
+[
+ <!ELEMENT SITES (VERSION, SITE+)>
+ <!ELEMENT VERSION (#PCDATA)>
+ <!ELEMENT SITE (ID, NAME, MAXADDR, MAXALIASES, MAXQUOTA, TYPE, DOMAINS?, USERS?, ALIASES?)>
+ <!ELEMENT DOMAINS (DOMAIN*)>
+ <!ELEMENT DOMAIN (#PCDATA)>
+
+ <!ELEMENT USERS (USER*)>
+ <!ELEMENT USER (ID, NAME, ROA, ROC, QUOTA, TYPE)>
+
+ <!ELEMENT ALIASES (ALIAS*)>
+ <!ELEMENT ALIAS (LEFTPART, RIGHTPART)>
+
+ <!ELEMENT ID (#PCDATA)>
+ <!ELEMENT NAME (#PCDATA)>
+ <!ELEMENT MAXADDR (#PCDATA)>
+ <!ELEMENT MAXALIASES (#PCDATA)>
+ <!ELEMENT MAXQUOTA (#PCDATA)>
+ <!ELEMENT TYPE (#PCDATA)>
+
+ <!ELEMENT ROA (#PCDATA)>
+ <!ELEMENT ROC (#PCDATA)>
+ <!ELEMENT QUOTA (#PCDATA)>
+
+ <!ELEMENT LEFTPART (#PCDATA)>
+ <!ELEMENT RIGHTPART (#PCDATA)>
+]
+>
+<SITES>
+<VERSION>1</VERSION>
+<SITE>
+ <ID>60</ID>
+ <NAME>abtauchen</NAME>
+ <MAXADDR>1</MAXADDR>
+ <MAXALIASES>1</MAXALIASES>
+ <MAXQUOTA>10240</MAXQUOTA>
+ <TYPE>p</TYPE>
+ <DOMAINS>
+ <DOMAIN>abtauchen.at</DOMAIN>
+ <DOMAIN>abtauchen.com</DOMAIN>
+ <DOMAIN>abtauchen.net</DOMAIN>
+ </DOMAINS>
+ <USERS>
+ <USER>
+ <ID>83</ID>
+ <NAME>info</NAME>
+ <ROA>y</ROA>
+ <ROC>n</ROC>
+ <QUOTA>10240</QUOTA>
+ <TYPE>p</TYPE>
+ </USER>
+ </USERS>
+ <ALIASES>
+ <ALIAS>
+ <LEFTPART>*</LEFTPART>
+ <RIGHTPART>info</RIGHTPART>
+ </ALIAS>
+ </ALIASES>
+</SITE>
+</SITES> \ No newline at end of file
diff --git a/dom/xml/crashtests/1405878.xml b/dom/xml/crashtests/1405878.xml
new file mode 100644
index 0000000000..12677ade93
--- /dev/null
+++ b/dom/xml/crashtests/1405878.xml
@@ -0,0 +1,11 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <body>
+ <select>
+ <script>document.documentElement.offsetHeight</script>
+ <option>Hello there</option>
+ </select>
+ <script>
+ document.querySelector("body").style.display = "inline";
+ </script>
+ </body>
+</html>
diff --git a/dom/xml/crashtests/1523655.xml b/dom/xml/crashtests/1523655.xml
new file mode 100644
index 0000000000..e905e9104d
--- /dev/null
+++ b/dom/xml/crashtests/1523655.xml
@@ -0,0 +1,3 @@
+<body>
+ <!-- XML root element with an known, allow-to-attch-shadow-root HTML tag name in non-HTML namespace should not trigger a crash -->
+</body>
diff --git a/dom/xml/crashtests/185285-1.xml b/dom/xml/crashtests/185285-1.xml
new file mode 100644
index 0000000000..9ab44d3356
--- /dev/null
+++ b/dom/xml/crashtests/185285-1.xml
@@ -0,0 +1,2 @@
+<link xmlns="http://www.w3.org/1999/xhtml" href="some.css" rel="stylesheet" />
+<x /> \ No newline at end of file
diff --git a/dom/xml/crashtests/382636-1.xml b/dom/xml/crashtests/382636-1.xml
new file mode 100644
index 0000000000..da5110ad05
--- /dev/null
+++ b/dom/xml/crashtests/382636-1.xml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body onload="document.cloneNode(true);">
+
+<img src="tree.gif" />
+
+</body>
+</html> \ No newline at end of file
diff --git a/dom/xml/crashtests/382636-2.svg b/dom/xml/crashtests/382636-2.svg
new file mode 100644
index 0000000000..2be0060eed
--- /dev/null
+++ b/dom/xml/crashtests/382636-2.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" onload="document.cloneNode(true);">
+
+<image xlink:href="tree.gif" width="49" height="60" />
+
+</svg>
diff --git a/dom/xml/crashtests/382636-3.xhtml b/dom/xml/crashtests/382636-3.xhtml
new file mode 100644
index 0000000000..da5110ad05
--- /dev/null
+++ b/dom/xml/crashtests/382636-3.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body onload="document.cloneNode(true);">
+
+<img src="tree.gif" />
+
+</body>
+</html> \ No newline at end of file
diff --git a/dom/xml/crashtests/382636-4.xhtml b/dom/xml/crashtests/382636-4.xhtml
new file mode 100644
index 0000000000..e1c65b9030
--- /dev/null
+++ b/dom/xml/crashtests/382636-4.xhtml
@@ -0,0 +1,5 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="try { document.cloneNode(true); } catch (e) { }">
+
+<image src="tree.gif" width="49" height="60" style="-moz-box-flex: 0" />
+
+</window>
diff --git a/dom/xml/crashtests/420429.xhtml b/dom/xml/crashtests/420429.xhtml
new file mode 100644
index 0000000000..e71af4ef21
--- /dev/null
+++ b/dom/xml/crashtests/420429.xhtml
@@ -0,0 +1,18 @@
+<?xml version="1.0"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ onload="boom();">
+
+<?xml-stylesheet?>
+
+<script type="text/javascript">
+
+function boom()
+{
+ window.addEventListener("DOMCharacterDataModified", function(){}, false);
+ document.documentElement.cloneNode(true).getElementsByTagName("*").length;
+}
+
+</script>
+
+</window>
diff --git a/dom/xml/crashtests/431703-1.xhtml b/dom/xml/crashtests/431703-1.xhtml
new file mode 100644
index 0000000000..622e4455cc
--- /dev/null
+++ b/dom/xml/crashtests/431703-1.xhtml
@@ -0,0 +1,17 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+<![CDATA[
+
+function boom()
+{
+ document.body.innerHTML = '<circle xmlns="http://www.w3.org/2000/svg" onload=""/>';
+}
+
+]]>
+</script>
+</head>
+
+<body onload="boom();"></body>
+
+</html>
diff --git a/dom/xml/crashtests/453278-frame.xml b/dom/xml/crashtests/453278-frame.xml
new file mode 100644
index 0000000000..7ced674cc5
--- /dev/null
+++ b/dom/xml/crashtests/453278-frame.xml
@@ -0,0 +1,3 @@
+<xml xmlns:xlink="http://www.w3.org/1999/xlink">
+<xml xlink:href="#" xlink:actuate="onLoad" xlink:type="simple"/>
+</xml>
diff --git a/dom/xml/crashtests/453278.html b/dom/xml/crashtests/453278.html
new file mode 100644
index 0000000000..f30ea3833e
--- /dev/null
+++ b/dom/xml/crashtests/453278.html
@@ -0,0 +1,9 @@
+<html>
+<head>
+<title> Bug 453278 - Crash [@ nsContentUtils::TriggerLink] with xlink stuff in display: none iframe</title><style>
+</style>
+</head>
+<body>
+<iframe id="content" src="453278-frame.xml" style="display: none;"></iframe>
+</body>
+</html>
diff --git a/dom/xml/crashtests/803586.xhtml b/dom/xml/crashtests/803586.xhtml
new file mode 100644
index 0000000000..002de07724
--- /dev/null
+++ b/dom/xml/crashtests/803586.xhtml
@@ -0,0 +1,8 @@
+<?xml-stylesheet href="foo.css" ?>
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+document.firstChild.nodeValue = null
+</script>
+</head>
+</html>
diff --git a/dom/xml/crashtests/994740-1.xhtml b/dom/xml/crashtests/994740-1.xhtml
new file mode 100644
index 0000000000..4d71cef27f
--- /dev/null
+++ b/dom/xml/crashtests/994740-1.xhtml
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+<![CDATA[
+
+function boom()
+{
+ document.createElement("head").innerHTML = "<";
+}
+
+]]>
+</script></head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/xml/crashtests/crashtests.list b/dom/xml/crashtests/crashtests.list
new file mode 100644
index 0000000000..158342c84d
--- /dev/null
+++ b/dom/xml/crashtests/crashtests.list
@@ -0,0 +1,14 @@
+load 136896-1.xml
+load 185285-1.xml
+load 382636-1.xml
+load 382636-2.svg
+load 382636-3.xhtml
+load chrome://reftest/content/crashtests/dom/xml/crashtests/382636-4.xhtml # Throws (bug 455856)
+load chrome://reftest/content/crashtests/dom/xml/crashtests/420429.xhtml
+load 431703-1.xhtml
+load 453278.html
+load 803586.xhtml
+load 994740-1.xhtml
+load 1038887.xhtml
+load 1405878.xml
+load 1523655.xml
diff --git a/dom/xml/crashtests/tree.gif b/dom/xml/crashtests/tree.gif
new file mode 100644
index 0000000000..360897e910
--- /dev/null
+++ b/dom/xml/crashtests/tree.gif
Binary files differ
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-28 17:37:43 +0000