diff options
| author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 09:22:09 +0000 |
|---|---|---|
| committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 09:22:09 +0000 |
| commit | 43a97878ce14b72f0981164f87f2e35e14151312 (patch) | |
| tree | 620249daf56c0258faa40cbdcf9cfba06de2a846 /testing/web-platform/tests/accessibility/crashtests | |
| parent | Initial commit. (diff) | |
| download | firefox-43a97878ce14b72f0981164f87f2e35e14151312.tar.xz firefox-43a97878ce14b72f0981164f87f2e35e14151312.zip | |
Adding upstream version 110.0.1.upstream/110.0.1upstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'testing/web-platform/tests/accessibility/crashtests')
32 files changed, 513 insertions, 0 deletions
diff --git a/testing/web-platform/tests/accessibility/crashtests/activedescendant-crash.html b/testing/web-platform/tests/accessibility/crashtests/activedescendant-crash.html new file mode 100644 index 0000000000..ac0dc5d5ed --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/activedescendant-crash.html @@ -0,0 +1,7 @@ +<iframe></iframe> +<script> +let frame = document.querySelector("iframe"); +window.xyz = frame.contentWindow.accessibilityController.focusedElement; +frame.remove(); +window.xyz.activeDescendant; +</script> diff --git a/testing/web-platform/tests/accessibility/crashtests/aom-in-destroyed-iframe.html b/testing/web-platform/tests/accessibility/crashtests/aom-in-destroyed-iframe.html new file mode 100644 index 0000000000..d412892983 --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/aom-in-destroyed-iframe.html @@ -0,0 +1,27 @@ +<html class="test-wait"> +<body></body> +<script> + const frameElem = document.createElement('iframe'); + + frameElem.srcdoc = '<html><head><title>X</title></head><body><div>-</div></body></html>'; + frameElem.onload = function() { + const frameDoc = frameElem.contentWindow.document; + + const divElem = frameDoc.querySelector('div'); + + getComputedAccessibleNode(divElem).then(function(divAccessible) { + // Close window. + frameElem.remove(); + + requestAnimationFrame(() => { + // Window removed, but we try to access DOM of non-existent window. + const isChecked = divAccessible.checked; + // Test is complete. + document.documentElement.className = ''; + }); + }); + }; + + document.body.appendChild(frameElem); +</script> +</html> diff --git a/testing/web-platform/tests/accessibility/crashtests/aria-hidden-with-select.html b/testing/web-platform/tests/accessibility/crashtests/aria-hidden-with-select.html new file mode 100644 index 0000000000..2aedbcfb82 --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/aria-hidden-with-select.html @@ -0,0 +1,25 @@ +<html class="test-wait"> +<head> +<script> +window.onload = function() { + requestAnimationFrame(() => { + requestAnimationFrame(() => { + document.querySelector('#will-hide').ariaHidden = 'true'; + document.documentElement.className = ''; + }); + }); +}; +</script> +</head> +<body> +<main> + <div id="will-hide"> + <div class="ignored"> + <select id="select"> + <option>1</option> + </select> + </div> + </div> +</main> +</body> +</html> diff --git a/testing/web-platform/tests/accessibility/crashtests/aria-owns-destroyed-by-content-replacement.html b/testing/web-platform/tests/accessibility/crashtests/aria-owns-destroyed-by-content-replacement.html new file mode 100644 index 0000000000..b64ebaa602 --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/aria-owns-destroyed-by-content-replacement.html @@ -0,0 +1,14 @@ +<html class="test-wait"> +<script> +window.onload = function fuzz() { + document.querySelector('audio').setAttribute('aria-owns', 'x1'); + requestAnimationFrame(() => { + document.querySelector('audio').removeAttribute('aria-owns'); + document.documentElement.className = ''; + }); +} +</script> +<audio> + <span id="x1"></span> +</audio> +</html> diff --git a/testing/web-platform/tests/accessibility/crashtests/aria-owns-fallback-content.html b/testing/web-platform/tests/accessibility/crashtests/aria-owns-fallback-content.html new file mode 100644 index 0000000000..8a7c9ab6d0 --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/aria-owns-fallback-content.html @@ -0,0 +1,19 @@ +<html class="test-wait"> +<body> +<div aria-owns="id1"></div> +<video> + <mark> + <span id='id1'></span> + </mark> +</video> +</body> +<script> +window.onload = () => { + requestAnimationFrame(() => { + requestAnimationFrame(() => { + document.documentElement.style.display = 'none'; + document.documentElement.className = ''; + }); + }); +} +</script> diff --git a/testing/web-platform/tests/accessibility/crashtests/aria-owns-reparent.html b/testing/web-platform/tests/accessibility/crashtests/aria-owns-reparent.html new file mode 100644 index 0000000000..2eaceb66f6 --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/aria-owns-reparent.html @@ -0,0 +1,21 @@ +<html class="test-wait"> +<script> +document.addEventListener("DOMContentLoaded", () => { + requestAnimationFrame(() => { + requestAnimationFrame(() => { + document.getElementById('owner').setAttribute('aria-owns','x'); + document.body.setAttribute('aria-hidden', 'true'); + document.documentElement.className = ''; + }); + }); +}); +</script> +</head> +<body> +<p id='owner'></p> + +<div> + <fieldset id='x'></fieldset> +</div> +</body> +</html> diff --git a/testing/web-platform/tests/accessibility/crashtests/aria-owns-select.html b/testing/web-platform/tests/accessibility/crashtests/aria-owns-select.html new file mode 100644 index 0000000000..d6cd094041 --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/aria-owns-select.html @@ -0,0 +1,11 @@ +<script> +function go(){ + setup() +} +document.addEventListener("DOMContentLoaded", () => { + document.querySelector('div').setAttribute('aria-owns','option1') +}); +</script> +<div></div> +<select> +<option id="option1"> diff --git a/testing/web-platform/tests/accessibility/crashtests/bdo-table-cell.html b/testing/web-platform/tests/accessibility/crashtests/bdo-table-cell.html new file mode 100644 index 0000000000..ae12541f8d --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/bdo-table-cell.html @@ -0,0 +1,21 @@ +<!doctype html> +<link rel="help" href="https://crbug.com/1314808"> +<style> +item:after { display: block; content: open-quote; } +item { display: list-item; } +</style> +<bdo style="direction:rtl"> + x<mark></mark> +</bdo> +<span style="display: table-cell; column-width: 0px;"></span> +<script> +const new_listitem_child = document.createElement('item'); +document.querySelector('mark').appendChild(new_listitem_child); +</script> + + +<!-- +ax_object.cc(739)] Check failed: child != this. Previous parent still has |this| child:\n +ERR: "\\"ListMarker\\" axid#14 <::marker> needsToUpdateChildren" should be a child of "\\"ListItem\\" axid#12 <item> needsToUpdateChildren" not of "\\"GenericContainer\\" axid#13 <::after> #children=2"\n + +--> diff --git a/testing/web-platform/tests/accessibility/crashtests/computed-accessible-child-of-pseudo-element.html b/testing/web-platform/tests/accessibility/crashtests/computed-accessible-child-of-pseudo-element.html new file mode 100644 index 0000000000..5bc1249907 --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/computed-accessible-child-of-pseudo-element.html @@ -0,0 +1,22 @@ +<html class="test-wait"> +<style> + h1::before { content: " [before] "; display: table; } +</style> + +<h1>Heading</h1> + +<script> +async function trigger1() { + let heading = document.querySelector('h1'); + let computed_accessible_node = await self.getComputedAccessibleNode(heading); + let first_child = computed_accessible_node.firstChild; + // The first child of the heading is a pseudo element <table>. + await first_child.ensureUpToDate(); + // The next child down has an accessibility object but no node. + let grand_child = first_child.firstChild; + await grand_child.ensureUpToDate(); + document.documentElement.className = ''; +} +trigger1(); +</script> +</html> diff --git a/testing/web-platform/tests/accessibility/crashtests/computed-accessible-text-node.html b/testing/web-platform/tests/accessibility/crashtests/computed-accessible-text-node.html new file mode 100644 index 0000000000..29b7c2b2fe --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/computed-accessible-text-node.html @@ -0,0 +1,14 @@ +<html class="test-wait"> +<img id="img1">text +<script> +async function trigger1() { + let img = document.getElementById('img1'); + let computed_accessible_node = await self.getComputedAccessibleNode(img); + // The next sibling is a text node. + let next_sibling = computed_accessible_node.nextSibling; + await next_sibling.ensureUpToDate(); + document.documentElement.className = ''; +} +trigger1(); +</script> +</html> diff --git a/testing/web-platform/tests/accessibility/crashtests/computed-node-checked.html b/testing/web-platform/tests/accessibility/crashtests/computed-node-checked.html new file mode 100644 index 0000000000..a413d26a01 --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/computed-node-checked.html @@ -0,0 +1,38 @@ +<!DOCTYPE html> +<html class="test-wait"> +<body> +</body> +<script src="/resources/testharness.js"></script> +<script> +if (window.chrome && chrome.gpuBenchmarking) { + chrome.gpuBenchmarking.pointerActionSequence( + [ + { + source: 'pen', + actions: [ + { name: 'pointerMove', x: 50, y: 50 } + ] + } + ] + ); +} +</script> +<script>step_timeout(gc, 50);</script> +<script> + const frameElem = document.createElement('iframe'); + + frameElem.srcdoc = '<div></div>'; + frameElem.onload = function() { + const frameDoc = frameElem.contentWindow.document; + const divElem = frameDoc.querySelector('div'); + getComputedAccessibleNode(divElem).then(function(divAccessible) { + frameElem.remove(); + requestAnimationFrame(() => { + const isChecked = divAccessible.checked; + document.documentElement.className = ''; + }); + }); + }; + document.body.appendChild(frameElem); +</script> +</html> diff --git a/testing/web-platform/tests/accessibility/crashtests/computed-node.html b/testing/web-platform/tests/accessibility/crashtests/computed-node.html new file mode 100644 index 0000000000..159b217a08 --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/computed-node.html @@ -0,0 +1,8 @@ +<body> +<iframe></iframe> +</body> +<script> +const iframe = document.querySelector('iframe'); +const option = document.createElement("option"); +iframe.contentWindow.getComputedAccessibleNode(option); +</script> diff --git a/testing/web-platform/tests/accessibility/crashtests/content-visibility-generated-content-removal.html b/testing/web-platform/tests/accessibility/crashtests/content-visibility-generated-content-removal.html new file mode 100644 index 0000000000..b880e244fe --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/content-visibility-generated-content-removal.html @@ -0,0 +1,32 @@ +<!DOCTYPE HTML> +<html class="test-wait"> +<style> + div { content-visibility: auto; } + div::after { content: "Bar" } +</style> +<div>Foo</div> +<div style="height:4000px"></div> +<script> + // Ensure no crash when removing element with generated content after + // `content-visibility: auto` content goes out of view. + requestAnimationFrame(() => { + requestAnimationFrame(() => { + // Let one layout run with the div content in view, then + // scroll it out of view. + document.scrollingElement.scrollTop = 3000; + + // Run three frames to ensure a new layout happens with the + // 'auto' content hidden (i.e. layout structures are + // destroyed), then remove the div with a pseudo element which + // was previously problematic. + requestAnimationFrame(() => { + requestAnimationFrame(() => { + requestAnimationFrame(() => { + document.querySelector('div').remove(); + document.documentElement.className = ''; + }) + }) + }) + }) + }); +</script> diff --git a/testing/web-platform/tests/accessibility/crashtests/delayed-ignored-change.html b/testing/web-platform/tests/accessibility/crashtests/delayed-ignored-change.html new file mode 100644 index 0000000000..226af19b5f --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/delayed-ignored-change.html @@ -0,0 +1,19 @@ +<html class="test-wait"> +<style> + body { font-size: x-large; } + .hidden { visibility: hidden; } +</style> +<rb class="hidden"> + <textarea></textarea> +</rb> +<script> +document.addEventListener('load', () => { + window.requestAnimationFrame(() => { + window.requestAnimationFrame(() => { + document.querySelector('style').remove(); + document.documentElement.className = ''; + }); + }); +}, true); +</script> +</html> diff --git a/testing/web-platform/tests/accessibility/crashtests/displaylocked-serialize.html b/testing/web-platform/tests/accessibility/crashtests/displaylocked-serialize.html new file mode 100644 index 0000000000..76784291b4 --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/displaylocked-serialize.html @@ -0,0 +1,14 @@ +<!DOCTYPE html> +<link rel=author href="mailto:jarhar@chromium.org"> +<link rel=help href="https://bugs.chromium.org/p/chromium/issues/detail?id=1291169"> + +<selectmenu></selectmenu> +<div></div> + +<script> + (async () => { + const selectmenu = document.querySelector('selectmenu'); + await getComputedAccessibleNode(document.querySelector('div')); + selectmenu.style.setProperty('content-visibility', 'hidden'); + })(); +</script> diff --git a/testing/web-platform/tests/accessibility/crashtests/iframe-owns-child.html b/testing/web-platform/tests/accessibility/crashtests/iframe-owns-child.html new file mode 100644 index 0000000000..a318e6aba9 --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/iframe-owns-child.html @@ -0,0 +1,2 @@ +<figure id="fig1"></figure> +<iframe aria-owns="fig1"></iframe> diff --git a/testing/web-platform/tests/accessibility/crashtests/iframe-srcdoc.html b/testing/web-platform/tests/accessibility/crashtests/iframe-srcdoc.html new file mode 100644 index 0000000000..74460048e0 --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/iframe-srcdoc.html @@ -0,0 +1 @@ +<iframe id="frame" style="content-visibility: hidden" srcdoc="\'<table>"</table>\'></iframe>xx diff --git a/testing/web-platform/tests/accessibility/crashtests/img-map-pseudo.html b/testing/web-platform/tests/accessibility/crashtests/img-map-pseudo.html new file mode 100644 index 0000000000..443934e431 --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/img-map-pseudo.html @@ -0,0 +1,11 @@ +<source> + <map name="map2" class="c1"> + <dfn class="c8"></dfn> + </map> +</source> +<img usemap="#map2"> +<style> +.c1:first-letter { content: "x"; } +.c8:after { content: "y"; } +.c1 { float: left; } +</style> diff --git a/testing/web-platform/tests/accessibility/crashtests/in-page-link-with-aria-hidden.html b/testing/web-platform/tests/accessibility/crashtests/in-page-link-with-aria-hidden.html new file mode 100644 index 0000000000..237707ba07 --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/in-page-link-with-aria-hidden.html @@ -0,0 +1,2 @@ +<p><a href="#dogs">cats</a> +<p id="dogs" aria-hidden="true">dogs</p> diff --git a/testing/web-platform/tests/accessibility/crashtests/included-descendant-dom-removal.html b/testing/web-platform/tests/accessibility/crashtests/included-descendant-dom-removal.html new file mode 100644 index 0000000000..fd978fb45e --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/included-descendant-dom-removal.html @@ -0,0 +1,27 @@ +<html class="test-wait"> +<head> +<script> +window.onload = function() { + requestAnimationFrame(() => { + requestAnimationFrame(() => { + document.querySelector('svg').remove(); + document.documentElement.className = ''; + }); + }); +}; +</script> +</head> +<body> +<div role="group" class="group"> + <div style="display:none" class="ignored1"> + <div class="ignored2"> + <div class="ignored3"> + <svg> <!-- Ignored --> + <g id="foo"></g> <!-- Ignored but included in tree --> + </svg> + </div> + </div> + </div> +</div> +</body> +</html> diff --git a/testing/web-platform/tests/accessibility/crashtests/included-descendant-layout-removal.html b/testing/web-platform/tests/accessibility/crashtests/included-descendant-layout-removal.html new file mode 100644 index 0000000000..5270a36351 --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/included-descendant-layout-removal.html @@ -0,0 +1,28 @@ +<html class="test-wait"> +<head> +<script> +window.onload = function() { + requestAnimationFrame(() => { + requestAnimationFrame(() => { + document.querySelector('svg').style.display = 'contents'; + document.documentElement.className = ''; + }); + }); +}; +</script> +</head> +<body> +<div role="group" class="group"> + <div class="ignored1"> + <div class="ignored2"> + <div class="ignored3"> + <svg role="none"> <!-- Ignored --> + <g id="foo"></g> <!-- Ignored but included in tree --> + <circle cx="10" cy="10" r="5" /> + </svg> + </div> + </div> + </div> +</div> +</body> +</html> diff --git a/testing/web-platform/tests/accessibility/crashtests/input-time-datalist.html b/testing/web-platform/tests/accessibility/crashtests/input-time-datalist.html new file mode 100644 index 0000000000..b27b77a767 --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/input-time-datalist.html @@ -0,0 +1,2 @@ +<input type=time list="suggestions"> +<datalist id=suggestions> diff --git a/testing/web-platform/tests/accessibility/crashtests/map-inside-map-2.html b/testing/web-platform/tests/accessibility/crashtests/map-inside-map-2.html new file mode 100644 index 0000000000..14ec36c99c --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/map-inside-map-2.html @@ -0,0 +1,11 @@ +<html> + <img usemap="map2" class="img-outside-map"> + <map name="map2"></map> + <script> + const img = document.createElement('img'); + img.className = 'img-inside-map'; + img.setAttribute('usemap', '#map2'); + img.style.visibility = 'collapse'; + document.querySelector('map').appendChild(img); + </script> +</html> diff --git a/testing/web-platform/tests/accessibility/crashtests/map-inside-map.html b/testing/web-platform/tests/accessibility/crashtests/map-inside-map.html new file mode 100644 index 0000000000..4ea41fdb3c --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/map-inside-map.html @@ -0,0 +1,16 @@ +<html> + <script> + const imgOutsideMap = document.createElement('img'); + imgOutsideMap.className="img-outside-map"; + imgOutsideMap.setAttribute('usemap', '#map2'); + document.documentElement.appendChild(imgOutsideMap); + const map = document.createElement('map'); + map.setAttribute('name', 'map2'); + document.documentElement.appendChild(map); + const imgInsideMap = document.createElement('img'); + imgInsideMap.className="img-inside-map"; + imgInsideMap.setAttribute('usemap', '#map2'); + imgInsideMap.style.visibility = 'collapse'; + map.appendChild(imgInsideMap); + </script> +</html> diff --git a/testing/web-platform/tests/accessibility/crashtests/move-owned-inside-another-owned.html b/testing/web-platform/tests/accessibility/crashtests/move-owned-inside-another-owned.html new file mode 100644 index 0000000000..babe8dcd1d --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/move-owned-inside-another-owned.html @@ -0,0 +1,13 @@ +<script> +window.onload = function() { + // Reparent z1 under z2. + const z2 = document.getElementById('z2'); + z2.appendChild(document.querySelector('#z1')); +} +</script> +<div aria-owns="z1 z2"> + <progress> + <div id="z1"></div> + <div id="z2"></div> + </progress> +</div> diff --git a/testing/web-platform/tests/accessibility/crashtests/multicol-with-text-change-role-relayout-crash.html b/testing/web-platform/tests/accessibility/crashtests/multicol-with-text-change-role-relayout-crash.html new file mode 100644 index 0000000000..d1ecd16dcb --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/multicol-with-text-change-role-relayout-crash.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html class="test-wait"> +<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org"> +<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1278439"> +<div id="container"> + <div id="mc" style="columns:2; column-fill:auto; width:200px; height:30px; line-height:20px; orphans:1; widows:1;"> + x<br> + x<br> + </div> +</div> +<script> + requestAnimationFrame(()=> { + requestAnimationFrame(()=> { + requestAnimationFrame(()=> { + mc.style.width = "201px"; + container.setAttribute("role", "treegrid"); + document.body.offsetTop; + document.documentElement.className = ""; + }); + }); + }); +</script> diff --git a/testing/web-platform/tests/accessibility/crashtests/object-with-unrendered-text-fallback.html b/testing/web-platform/tests/accessibility/crashtests/object-with-unrendered-text-fallback.html new file mode 100644 index 0000000000..0128213bfc --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/object-with-unrendered-text-fallback.html @@ -0,0 +1,11 @@ +<!DOCTYPE html> +<style> +caption:first-letter { color: red; } +</style> + +<object> + <table> + <caption dir="rtl">)))XX?</caption> + </table> +</object> + diff --git a/testing/web-platform/tests/accessibility/crashtests/serialize-with-no-document.html b/testing/web-platform/tests/accessibility/crashtests/serialize-with-no-document.html new file mode 100644 index 0000000000..f7719cf2ff --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/serialize-with-no-document.html @@ -0,0 +1,5 @@ +><a>feColorMatrix><div id="container"><0<script>0000A00AAAAA00A<tspan></tspan>000<do>AA0AA0<fieldset></fieldset>A00AA<font><feComponentTransfer></feComponentTransfer><insertedLegend>AAA0A0A0A00A<img>0<link>0A00A0AAAAAA0AAA000A<feDiffuseLighting><mfrac></mfrac><anchor></anchor>00A0<tspan><tspan><tspan><dcol></dcol><missing_glyph></missing_glyph><col></col>0A0AAA0AA0AA0A000A0<mover></mover><form></form><dcol><dcol><dcol><dcol><dcol>⊵≜╤⧫Σ⨀⊾Ѕ⊭↑⧞⪡<math><dt></dt><feTile></feTile>AA0A<isindex></isindex><blockquote>0<mo></mo>AA0A00A00<cursor><desc></desc>AAAA0AA<tref></tref><tref></tref>0AA00AA0<noop></noop><tfoot><insertedLegend></insertedLegend><insertedLegend></insertedLegend><insertedLegend></insertedLegend><insertedLegend></insertedLegend><template></template>00AA00A00AAAAAA00AA<msubsup><legend>0A00AA0A<msub>AA000AAAA<td>0A0AA0A0AA0A000A0AAA<feFlood><ruby>0A000AA00AAAA0AAAA0A<br><feImage>AAA<font>A0000000AAA0AA00<button><video></video>00AA0</div> +</script><script> + var child = new AccessibleNode(); + container.accessibleNode.appendChild(child); +</script><a> diff --git a/testing/web-platform/tests/accessibility/crashtests/slot-assignment-lockup.html b/testing/web-platform/tests/accessibility/crashtests/slot-assignment-lockup.html new file mode 100644 index 0000000000..85b6c9294a --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/slot-assignment-lockup.html @@ -0,0 +1,34 @@ +<html class="test-wait"> +<body> +<script> +customElements.define("my-detail", class extends HTMLElement { + constructor() { + super(); + this.attachShadow({ mode: "open", slotAssignment: "manual" }); + } + connectedCallback() { + const slot1 = document.createElement("slot"); + const child1 = document.createElement("span"); + this.appendChild(child1); + child1.innerHTML = "x"; + this.shadowRoot.appendChild(slot1); + slot1.style.display = "block"; + slot1.assign(child1); + } +}); + +function fuzz() { + document.designMode = 'on'; + document.execCommand("selectAll"); + document.execCommand("InsertText"); + document.documentElement.className = ''; +} +window.onload = () => { + requestAnimationFrame(() => { + requestAnimationFrame(fuzz); + }); +}; +</script> +<my-detail></my-detail> +</body> +</html> diff --git a/testing/web-platform/tests/accessibility/crashtests/svg-mouse-listener.html b/testing/web-platform/tests/accessibility/crashtests/svg-mouse-listener.html new file mode 100644 index 0000000000..e52909f0f6 --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/svg-mouse-listener.html @@ -0,0 +1,13 @@ +<!DOCTYPE html> +<script src="/resources/testdriver.js"></script> +<script src="/resources/testdriver-vendor.js"></script> +<script src="/resources/testdriver-actions.js"></script> +<svg viewBox="0 0 500 500"> + <rect width="500" height="500" id="target" fill="red"> +</svg> + +<script> +document.getElementById("target").addEventListener("click", () => {}, { once: true }); + +test_driver.click(document.body); +</script> diff --git a/testing/web-platform/tests/accessibility/crashtests/table-ignored-child.html b/testing/web-platform/tests/accessibility/crashtests/table-ignored-child.html new file mode 100644 index 0000000000..99f385f6ea --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/table-ignored-child.html @@ -0,0 +1,18 @@ +<html> +<head> +<script> +window.onload = function() { + document.querySelector('object').appendChild(document.querySelector('#move-me')); +}; +</script> +</head> +<body dir="rtl"> +<object></object> +<table> + <caption style="display:none"> + <span> + <div id="move-me"></div> + </span> + </caption> +</table> +</body> diff --git a/testing/web-platform/tests/accessibility/crashtests/validation-message.html b/testing/web-platform/tests/accessibility/crashtests/validation-message.html new file mode 100644 index 0000000000..259c01cd3a --- /dev/null +++ b/testing/web-platform/tests/accessibility/crashtests/validation-message.html @@ -0,0 +1,5 @@ +<html> +<form><input required><input type=submit id=submit><script> +submit.click(); +</script> +</html><!-- Comment required for test to crash --> |