diff options
Diffstat (limited to 'dom/smil/crashtests')
63 files changed, 1219 insertions, 0 deletions
diff --git a/dom/smil/crashtests/1010681-1.svg b/dom/smil/crashtests/1010681-1.svg new file mode 100644 index 0000000000..882bcb53fe --- /dev/null +++ b/dom/smil/crashtests/1010681-1.svg @@ -0,0 +1,23 @@ +<?xml version="1.0" encoding="UTF-8"?> +<svg xmlns="http://www.w3.org/2000/svg" + class="reftest-wait"> +<script> +<![CDATA[ + +function boom() +{ + var animate = + document.createElementNS("http://www.w3.org/2000/svg", "animate"); + animate.setAttribute("dur", "2s"); + document.documentElement.appendChild(animate); + animate.targetElement; + animate.requiredExtensions.insertItemBefore(0, 0); + document.documentElement.setCurrentTime(4); + document.documentElement.setCurrentTime(0); + document.documentElement.removeAttribute("class"); +} + +window.addEventListener("load", boom, false); + +]]> +</script></svg> diff --git a/dom/smil/crashtests/1322770-1.svg b/dom/smil/crashtests/1322770-1.svg new file mode 100644 index 0000000000..405435184e --- /dev/null +++ b/dom/smil/crashtests/1322770-1.svg @@ -0,0 +1,3 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <animateMotion keyTimes='.1;.6;.6' path='m0,1l7,3' keyPoints='.6;1;.7'/> +</svg> diff --git a/dom/smil/crashtests/1322849-1.svg b/dom/smil/crashtests/1322849-1.svg new file mode 100644 index 0000000000..ea3d629813 --- /dev/null +++ b/dom/smil/crashtests/1322849-1.svg @@ -0,0 +1,2 @@ +<svg> +<set fill='freeze' dur='8' repeatCount='1844674737095516'> diff --git a/dom/smil/crashtests/1343357-1.html b/dom/smil/crashtests/1343357-1.html new file mode 100644 index 0000000000..8219c31221 --- /dev/null +++ b/dom/smil/crashtests/1343357-1.html @@ -0,0 +1,12 @@ +<svg> + <animateMotion to="500,500"></animateMotion> + <animateMotion to="10,40"></animateMotion> +</svg> +<svg width="100" height="100"> + <rect width="100%" height="100%" /> + <circle r="2" fill="red"> + <animateMotion dur="1s" from="50,50" to="80,70" additive="sum"></animateMotion> + <animateMotion dur="1s" from="50,50" to="80,70" additive="sum"></animateMotion> + <animateMotion dur="3s" to="0,80"></animateMotion> + </circle> +</svg> diff --git a/dom/smil/crashtests/1375596-1.svg b/dom/smil/crashtests/1375596-1.svg new file mode 100644 index 0000000000..69c1673d11 --- /dev/null +++ b/dom/smil/crashtests/1375596-1.svg @@ -0,0 +1,3 @@ +<svg xmlns="http://www.w3.org/2000/svg" width="800" height="600"> +<animate by="2" min="5:45" calcMode="discrete" attributeName="height" /> +</svg> diff --git a/dom/smil/crashtests/1402547-1.html b/dom/smil/crashtests/1402547-1.html new file mode 100644 index 0000000000..28fa7ce185 --- /dev/null +++ b/dom/smil/crashtests/1402547-1.html @@ -0,0 +1,3 @@ +<svg> +<animate id='a' calcMode='discrete' attributeName='height' by='-159'/> +<animate id='a' calcMode='discrete' attributeName='height' by='-159'/> diff --git a/dom/smil/crashtests/1411963-1.html b/dom/smil/crashtests/1411963-1.html new file mode 100644 index 0000000000..cc61b73e2a --- /dev/null +++ b/dom/smil/crashtests/1411963-1.html @@ -0,0 +1,10 @@ +<html> + <head> + <script> + const o1 = document.createElement('div'); + document.querySelector('script').appendChild(o1); + document.writeln("<svg><animate to attributeName='width'>"); + o1.innerHTML = "<meta http-equiv='Content-Security-Policy' content=default-src>"; + </script> + </head> +</html> diff --git a/dom/smil/crashtests/1413319-1.html b/dom/smil/crashtests/1413319-1.html new file mode 100644 index 0000000000..9bfeef3bdd --- /dev/null +++ b/dom/smil/crashtests/1413319-1.html @@ -0,0 +1,2 @@ +<svg width=''> +<animate dur='2ms' repeatCount='4611686018427387903' fill='freeze'/> diff --git a/dom/smil/crashtests/1535388-1.html b/dom/smil/crashtests/1535388-1.html new file mode 100644 index 0000000000..cdfaba4d90 --- /dev/null +++ b/dom/smil/crashtests/1535388-1.html @@ -0,0 +1,18 @@ +<html> +<head> +<script> +function start () { + document.location.assign('abc') + SpecialPowers.forceGC() + SpecialPowers.forceCC() + const XHR = new XMLHttpRequest() + XHR.open('GET', 'data:text/html,1', false) + XHR.send() +} +window.addEventListener('load', start) +</script> +</head> +<body> +<svg></svg> +</body> +</html> diff --git a/dom/smil/crashtests/1780800-1.html b/dom/smil/crashtests/1780800-1.html new file mode 100644 index 0000000000..14129a627c --- /dev/null +++ b/dom/smil/crashtests/1780800-1.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<head> +<script> +document.addEventListener("DOMContentLoaded", () => { + const svg = document.createElementNS("http://www.w3.org/2000/svg", "svg"); + const set = document.createElementNS("http://www.w3.org/2000/svg", "set"); + svg.appendChild(set); + document.documentElement.appendChild(svg); + const animation = new Animation(); + animation.addEventListener("finish", () => + svg.setAttribute("pointer-events", "visible") + ); + animation.startTime = 2713; + document.addEventListener("DOMAttrModified", e => { + e.originalTarget.setCurrentTime(1.050520798894502e38); + document.documentElement.removeAttribute("class"); + }); +}); +</script> +</head> +</html> diff --git a/dom/smil/crashtests/483584-1.svg b/dom/smil/crashtests/483584-1.svg new file mode 100644 index 0000000000..b9ded113ef --- /dev/null +++ b/dom/smil/crashtests/483584-1.svg @@ -0,0 +1,8 @@ +<svg xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink"> + <g id="s"> + <circle/> + <animateTransform attributeName="transform"/> + </g> + <use xlink:href="#s"/> +</svg> diff --git a/dom/smil/crashtests/483584-2.svg b/dom/smil/crashtests/483584-2.svg new file mode 100644 index 0000000000..f5cbd7d466 --- /dev/null +++ b/dom/smil/crashtests/483584-2.svg @@ -0,0 +1,133 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!-- =====================================================================--> +<!-- animate-elem-30-t.svg --> +<!-- --> +<!-- Tests various types of animations on referenced elements. --> +<!-- --> +<!-- Author : Ola Andersson, 22-Sep-2003 --> +<!--======================================================================--> +<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1 Tiny//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11-tiny.dtd"> +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" baseProfile="tiny" id="svg-root" width="480" height="360" viewBox="0 0 480 360" onload="go()" class="reftest-wait"> + <script> + function go() { + var svg = document.documentElement; + svg.pauseAnimations(); + + // Note: Animations in this testcase have begin="100" dur="3". + + // Jump to partway through animation... + svg.setCurrentTime(102); + + // ...and then (if we didn't hang) jump back to a pre-animation time. + svg.setCurrentTime(50); + + // Signal that the test is complete: + svg.removeAttribute("class"); + } + </script> + <g transform="translate(20) scale(1.3)"> + <!-- SILHOUETTES--> + <path d="M210 40 C210 40 210 100 170 190" fill="none" stroke="#b4b4b4"/> + <path d="M 171 188 l 10 -10 l -10 -4 z" fill="#b4b4b4" stroke="none"/> + <polyline fill="none" stroke="#b4b4b4" stroke-width="2" points="200,20 200,40 220,40 220,60"/> + <polyline transform="rotate(15)" fill="none" stroke="#b4b4b4" stroke-width="9" points="200,120 200,140 220,140 220,160"/> + + <line x1="40" y1="50" x2="20" y2="10" stroke="#b4b4b4" stroke-width="3"/> + <line x1="160" y1="50" x2="80" y2="10" stroke="#b4b4b4" stroke-width="3"/> + <line x1="30" y1="30" x2="120" y2="30" stroke="#b4b4b4"/> + <path d="M 120 30 l -10 3 l 0 -6 z" fill="#b4b4b4" stroke="none"/> + + <line x1="70" y1="70" x2="145" y2="70" stroke="#b4b4b4"/> + <rect x="10" y="60" width="60" height="20" fill="#b4b4b4" stroke="#b4b4b4" stroke-width="2"/> + <rect x="145" y="60" width="30" height="40" fill="#b4b4b4" stroke="#b4b4b4" stroke-width="2"/> + <path d="M 145 70 l -10 3 l 0 -6 z" fill="#b4b4b4" stroke="none"/> + + <circle cx="30" cy="100" r="10" fill="#b4b4b4" stroke="#b4b4b4"/> + <circle cx="100" cy="195" r="15" fill="#b4b4b4" stroke="#b4b4b4"/> + <line x1="37" y1="107" x2="89" y2="184" stroke="#b4b4b4"/> + <path d="M 90 185 l -3 -12 l -6 5 z" fill="#b4b4b4" stroke="none"/> + + <rect x="300" y="10" width="20" height="20" fill="#b4b4b4" stroke="#b4b4b4" stroke-width="2"/> + <rect x="300" y="170" width="20" height="40" fill="#b4b4b4" stroke="#b4b4b4" stroke-width="2"/> + <line x1="310" y1="30" x2="310" y2="170" stroke="#b4b4b4"/> + <path d="M 310 170 l -3 -10 l 6 0 z" fill="#b4b4b4" stroke="none"/> + + <rect x="230" y="7.5" width="40" height="7.5" fill="#b4b4b4" stroke="none"/> + <rect x="230" y="170" width="40" height="30" fill="#b4b4b4" stroke="none"/> + <line x1="250" y1="10" x2="250" y2="170" stroke="#b4b4b4"/> + <path d="M 250 170 l -3 -10 l 6 0 z" fill="#b4b4b4" stroke="none"/> + <!-- END OF SILHOUETTES--> + + <!-- DEFS--> + <defs> + <line id="lineID" x1="30" y1="50" x2="10" y2="10" stroke="rgb(16, 93, 140)" stroke-width="3"> + <animate attributeName="x1" from="30" to="90" begin="100" dur="3" fill="freeze"/> + </line> + </defs> + + <defs> + <rect id="rectID" x="10" y="60" width="60" height="20" fill="blue" stroke="black" stroke-width="2"> + <animateColor attributeName="fill" from="white" to="rgb(16, 93, 140)" begin="100" dur="3" fill="freeze"/> + <animate attributeName="height" from="20" to="40" begin="100" dur="3" fill="freeze"/> + </rect> + </defs> + + <defs> + <circle id="circleID" cx="20" cy="100" r="10" fill="rgb(16, 93, 140)" stroke="black" transform=""> + <animate attributeName="cy" from="100" to="130" begin="100" dur="3" fill="freeze"/> + <animateTransform attributeName="transform" type="scale" from="1" to="1.5" additive="sum" begin="100" dur="3" fill="freeze"/> + </circle> + </defs> + + <defs> + <polyline id="polylineID" fill="none" stroke="rgb(16, 93, 140)" stroke-width="2" points="200,20 200,40 220,40 220,60"> + <animateMotion path="M 0 0 l 0 100" begin="100" dur="3" fill="freeze"/> + <animate attributeName="stroke-width" from="2" to="9" begin="100" dur="3" fill="freeze"/> + </polyline> + </defs> + + <defs> + <polygon id="polygonID" fill="green" stroke="black" points="240,20 240,40 260,40 260,20" stroke-width="2"> + <animate attributeName="fill" from="white" to="rgb(16, 93, 140)" begin="100" dur="3" fill="freeze"/> + </polygon> + </defs> + + <defs> + <image id="imageID" x="230" y="20" width="40" height="80" xlink:href="data:image/jpeg;base64,/9j/4AAQSkZJRgABAgEASABIAAD/4RX+RXhpZgAASUkqAAgAAAAJAA8BAgAGAAAAegAAABABAgAXAAAAgAAAABIBAwABAAAAAQAAABoBBQABAAAAoAAAABsBBQABAAAAqAAAACgBAwABAAAAAgAAADIBAgAUAAAAsAAAABMCAwABAAAAAQAAAGmHBAABAAAAxAAAAGYFAABDYW5vbgBDYW5vbiBESUdJVEFMIElYVVMgMzAwAAAAAAAAAAAAALQAAAABAAAAtAAAAAEAAAAyMDAyOjAxOjE1IDA0OjQyOjU4ABsAmoIFAAEAAABWAwAAnYIFAAEAAABeAwAAAJAHAAQAAAAwMjEwA5ACABQAAAAOAgAABJACABQAAAAiAgAAAZEHAAQAAAABAgMAApEFAAEAAAA+AwAAAZIKAAEAAABGAwAAApIFAAEAAABOAwAABJIKAAEAAABmAwAABZIFAAEAAABuAwAABpIFAAEAAAB2AwAAB5IDAAEAAAAFAAAACZIDAAEAAAAAAAAACpIFAAEAAAB+AwAAfJIHAJoBAACGAwAAhpIHAAgBAAA2AgAAAKAHAAQAAAAwMTAwAaADAAEAAAABAAAAAqADAAEAAABABgAAA6ADAAEAAACwBAAABaAEAAEAAAAwBQAADqIFAAEAAAAgBQAAD6IFAAEAAAAoBQAAEKIDAAEAAAACAAAAF6IDAAEAAAACAAAAAKMHAAEAAAADAAAAAAAAADIwMDI6MDE6MTUgMDQ6NDI6NTgAMjAwMjowMToxNSAwNDo0Mjo1OAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAAAAQAAAPUAAAAgAAAA1QAAACAAAAABAAAAyAAAAGQAAAAKAAAAAAAAAAMAAACs3QIAAAABAP//AADoAwAAMAEAACAAAAAMAAEAAwAmAAAAHAQAAAIAAwAEAAAAaAQAAAMAAwAEAAAAcAQAAAQAAwAaAAAAeAQAAAAAAwAGAAAArAQAAAAAAwAEAAAAuAQAAAYAAgAgAAAAwAQAAAcAAgAYAAAA4AQAAAgABAABAAAAcVYQAAkAAgAgAAAA+AQAABAABAABAAAAAAAEAQ0AAwAEAAAAGAUAAAAAAABMAAIAAAADAAEAAAAAAAQAAAABAAAAAAAAAAAAAAAAAAAAAwABAAEwAAD/////BgKtACAAdADVAP//AAAAAAAAAAAAAP//AABABkAGAgAwAdMAngAAAAAAAAAAADQAAACPAD8B1QD1AAAAAAAAAAEAAwAAAAAAAAAHMAAAAAAAAAAA//8AANUA+QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAElNRzpESUdJVEFMIElYVVMgMzAwIEpQRUcAAAAAAAAARmlybXdhcmUgVmVyc2lvbiAxLjAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAPQA9AD0AABqGADOAAAAgE8SAJsAAAAEAAEAAgAEAAAAUjk4AAIABwAEAAAAMDEwMAEQAwABAAAAQAYAAAIQAwABAAAAsAQAAAAAAAAGAAMBAwABAAAABgAAABoBBQABAAAAtAUAABsBBQABAAAAvAUAACgBAwABAAAAAgAAAAECBAABAAAA9AUAAAICBAABAAAA7g8AAAAAAAC0AAAAAQAAALQAAAABAAAA//////////////////////////////////////////////////9//////////////9j/2wCEAAkGBggGBQkIBwgKCQkLDRYPDQwMDRwTFRAWIR0jIiEcIB8kKTQsJCcxJx4fLT0tMTY3Ojo6Iio/RD44QjM3OTYBCQkJDAoMFAwMFA8KCgoPGhoKChoaTxoaGhoaT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT//AABEIAHgAoAMBIQACEQEDEQH/xAGiAAABBQEBAQEBAQAAAAAAAAAAAQIDBAUGBwgJCgsQAAIBAwMCBAMFBQQEAAABfQECAwAEEQUSITFBBhNRYQcicRQygZGhCCNCscEVUtHwJDNicoIJChYXGBkaJSYnKCkqNDU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6g4SFhoeIiYqSk5SVlpeYmZqio6Slpqeoqaqys7S1tre4ubrCw8TFxsfIycrS09TV1tfY2drh4uPk5ebn6Onq8fLz9PX29/j5+gEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoLEQACAQIEBAMEBwUEBAABAncAAQIDEQQFITEGEkFRB2FxEyIygQgUQpGhscEJIzNS8BVictEKFiQ04SXxFxgZGiYnKCkqNTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqCg4SFhoeIiYqSk5SVlpeYmZqio6Slpqeoqaqys7S1tre4ubrCw8TFxsfIycrS09TV1tfY2dri4+Tl5ufo6ery8/T19vf4+fr/2gAMAwEAAhEDEQA/AOxApcV7J5goUngDNIVweaBC80oYjvRYLseszAY60FjI3c1HLZ3L5r6DjG46jFRFjTVmJtoA5qW3j3vuIBAokuVNgnzOxpKVA5xUNyY3TB4Fc0b3Oh2sZbqAxx0pMV2pnG9xNtJincA20hWmBMBT1XJrJuxaLf7pU4wKqScuayp3vqaTtbQABjmnRJunQdiRVtuz8kQlsa0kUUg+ZFP4VVeyUNuiJB9DXn060oabx6o7Z0oy12l3I5pMDawwcVTIrupbX6PY46u9uq3ExT0kZBxWrV9DNOw4zue9MZi3U0lFIbm2NwKTFUIMUmKYgxSYoAmAFP2+9Z3NLCbaTbzRcmw9baR13KpIp8ETLcpuUjnvWcqsbNXXMk9DSNOV07aX3NInFNPTmvLO8iljWVcN19az2hZZNmMkniuzC1LXg9t0c2Ihe0lv1JZrGWEZIBX1FV8V1U6iqK6+aOacHB2fyYYorQkMUmKYgxSYoEGKTFAyYCnYrM0FCM33VJ+go8mQfwN+VS5xWjaTDlk9kzSRBHGq+gpoO6ZB6mvLk7tvuz0ErK3YlkIQVAz0hkZamhlWRXIztNCdtVuDV9zRDBlBGCCKz7uyO8NCuQeoHatqFTkld/C9zOrDnj5rYYunSn7xVfqaf/Zn/TTn/drpli4p6Lm89jnjhn1dvIo3TRWt5HbGQNNICwUdQB3NGK3pVPaR5tvIyqQ5HbfzDFJitDMMUYoAlxSgVmaGlAAkCjvjNKeTXlzd5N92ehFWSXZCHmoyQjBj2qGUMkn3GojJQA0yUKGf7ozQBbtd6x4fgZ4qxmhMGGcCsjxP4ktvDGiS39yQSPljjzy79hTEcN8P7y51mbUNd1KQGSZxGrHgDP8ACPyFdtivRw1vZ6dHqcNe/P6rQcIXPRGP4UxsLJ5bEB8Z298etbc8b2ur9jLkklezt3DFGKsRLQKzLNFJULiPeofGduecfSiR/wB4qD6mvIb/ADPSQuPWqt+3lxKfVgKT2AqmSk3E9KALUFkW+aTgelWtqhhGgx647Cj+kBI/3Pl7UwOCMijqBICGXNcj448Ax+MfLkN/NbyQqRGmA0fPcj+tMCPwz8PRpWnWcN/ePKYG83yovljL+p7nH4V1sjQWcLSyFIo0GWduAB9apSaVk7J7onlTd+q2Z5n4x+MKWxa08PKJW+610w4B/wBkd/rWr4Es7pdE/tDUpHlvb7EsjyHJ2/wj8j+tb4WN537IyxDtC3dnSYpMV6Jwkt8sktm6wSLFMynY5G7afpXkl3Y61qVyY7zVrkxkncN52kewBx+lediJuKWrSfQ76EVJvRO3Ut6zo0+p3Ed19rc3MUYRC3QADjGOhrofCGvz6bpPk61cyTXab9ryMWLDjA3f56VxKVzqcbGA/wAWdZtrly8CGLcdvm2xAx9Q2f0rc0P4lDxPKbae2t4XjXzN0UrENj/ZZRj86p/CQtzoZryKCJpZpFSNeSxPArk7z4iTC/UaMtkYUJ3SXT43n0AH86Fq7feGxq6Z8VbOWdLfVbY20zEKrwSCaMn8OR+VXbn4laFp9xLDJJcSzLkuIoSQvtk4FNiSuZU3xhtCT9i0i7nHrJIkf9TWx4Y8YxeIIpC8Is5g3+pMofH48UPa4Lsak3iTTbGyuJ7m6RI7Ztsp67T9PxqDTPG2ia7c/ZdMvBNMRu27COO55FF9ANHV9Zs9D097u+lEcSD8WPoBXhPjf4g6j4puWt4w9tYqflhBwW929aa19AMTw9aW93rlnDqEghtjMDIzdMelfREQR4lMJUxkfKV6Y9q7sK1Z9zkxKd12HbKPLrsucyRxsuuXeq25SOUKu8gPESpOPftWMblrWcLJueI/dmHI/E/1rw61R1Ja9NkevSgoR069TQVy6EoVbjiqsy3ZiO+GFXGNoEpIP47axNSgEvPNEF2trI0udqtKRkAc8bKbaaVGkpntbK383JV2W4ZcH0+7zVXttdE2vvZly4tLq8h8q5t4pIyeVN45H/oFVR4cjwB/Zdpjtm6f/wCJpKVurHy+SLFto2m7leK3iEqHBKMTtYe9OGmafcM8hgjkdnIdjzn1pOTGoortoMIkbytNsiueCzkE/wDjpp8FobWbZb2llE57JMQf/QafN5sXL5IfPo8l4jR3SoiH5iEkLZYdCQRin2tzc6FeR3S+XIkYwX+6Rn17VUZW03RMoX12Zj+JdQufEOprcXOr26LH/q4lOQtZc2keYd0uqQMQOpQZquZ9mRZdyGDRx5+WvbfAPH3Rmuy0XXLzw/A/2cG7gJ4QPuVfy71pTquDvYmcFNWbNmx+JFoqyfb4pyxclfLjXCr2H3ucetaVt4+0W4OPOkiP/TRMfrXbHFQe90zklhpLazRyMNxZ21v5K288aHPApIb3TbW0S2iSZUUbQCCePQ15soy6pps7ozj0asgtLnTbIsIXmVDzsIOF+lWDqliwO6duTkEjpUtd0ylLzRQ1KPS9TMZkvZImiyFaNtp5x/hViyfT9Ph8q3uiUzn5jk/nQ2rWBb3Lkd/bYybhT7U4X9sDj7SnHvU6FXZS8i3NvPHHqAjMzM+4EAqSe1Q6fNp+kWotZNTEzK2Q0jYNVvsTe2uyJW16yQEC+gbHvTtN8S6PaXsk1xHFdyOVKlwMIADkA571SjZ9/IHJNb2H3niawu7xpYpEgjzxGqggD65rOnbTjayQx3yqkyjOV3EHGOxH5UW12Fdd9jMtvDmhxXsdw140qoM+U0eVc+/tTNV8PWd/J5kV4kSseALfvgZ6DNac2mxHKu5WPgm23AW+qOwZQDut2Xn04zxnFT2ng9LEiSLWbm3nGdzRWz4Ht2zS5vIfL5mja2chB+33kF1nAz5Tow/HFOm0mFoSI7xAwPyoyEjHfnH9PWpv6jS80dK8cJGdwz9aiFvHnOBXqSVzzouwvkJnBVc/SnizQ/8ALMflXPKKNVJgbCIjmMflUf2C3brEpH+7kVm4ItSGtpdqRzBHj12CoG0mzbAMMeO3FR7MrmFGkWfCmEfhUM3hyykk3FXBPo5oVJBzsrt4QsHck+aPo/8A9aoz4K08E/vJP0P9Kr2fYnnI5PBViQQJZF/Af4VA3gi1B4nbp/cWj2TH7Qhk8GQAACZuneMCq0vhDYMpMufdf/r1SovuJ1UVz4WlLcNH9cH/ABqQeDLhjlZIPx3CmsPJ9SXWS6Cnwhfx/ceL8JmH9KP+Ea1ZD8s34i5Yf0p/Vp+TBYiPmd35eOgIoAJHBH511M50O29C4U47mnhQykBiT6BqxZqhwJTG4N9OtSrtY98+/Ws5eRcfMCgJzj2yKjaMZ64x6VCZTQ5VULyfxNIGRgR5gb2NUri0HeUj5GUcdhjpQzIBhlyvrkD+tUtfInReY37RbO2zcPTOajaKFXz5hI+uaaUkDcWRzRIVzge2BVaXYCBzitY/kZSsvmQmNQc5qSEAg7cH29K0iRIcSGGGcj2yKcANuA/Hck5NWQSzzKR8u/B6hRinIwAA+bH8qybNUSD/AH2A9MnFPDYXA5H51k0aIRkDMA0av6e1SCFduCij6VnJtFJJiGCI9ET64puVU4wc+oBqE2y7JApTdtXeD64OKcx6DJB9s1RIi5ZuCAMdQc0hWRELABiO3JNVdE2ZD+9UBinPcBj/AIUiXEj5DAoMd8mrsmTdr5jHBA+VcH1AzUTKyj69+laRsQ7kZXPynDe2KdHDGP8Alnj8K0RmxzBAOij0HSnxIsikMiqPUNVCHS28RxvJJ+tMEaRP8oOPUtmsWaIsIePf2pySgdT9NwrFo1TFNxs5YoR2waYssLO3mJHk9e+aVn0uO662BhCWyhUevz8flTiM/wCrOf8AgVRfv99i15fdcbmVcMUZiB0UgioJL64QkfZZAPUNVxSe1iJSa6MbHfSsQVtnXuS3FTfanYjfGoxxgfMavl8yObyHl02kLGcn/pkaYJJBn5MA+vGaSXdjv2RCbmYEqVXPs1NeUsvJXPrWkUlsQ5N76EQjycb2+meKsIDj1x6CtIoiV+o/eQvfHuKA/wAvYfhVkjC0gHVQfXFRkXDYO9GI6DFYNmthn+mZz8uP9lQamjmuVA/csffgVDsylddCdLhgp3oE79aie5lxhFWQexJqeW3Urm8vkVvt8gfbIoA/3CDVhJVxlCg+oNJx82ClforoZNdXce0pFGy/3gc5pq307H96kZB7KDQoIHN9kSf2gVOFXr2KkU7+1sAB1z9Oark8xe0EXU4n6RsD9KSd4WQFhz24zTUXHzE5KXkQOY9uMNjsNtIEj2/xfTbjNap+RnZdxu1edq7f6frT0hdlyJG/4C55ql9xLEMjxcBps/gc09LknO/cfZkH+NNaAOUTyjLsY19AaUzJHncWPrmsWro1TsC38J6tge4NONxBMAFc59FJrFprbU1Ti9HoD2sLJhmbHo3SmJZwA5Bj46dqqM7kygiVJkiB+YnPbPFMa9jfcFwSPek43dxqSSsNa7mUbvLVB7tSHUHWLcYmHtkHNCh5sXP5EB1p0TAtHx6g4/lU0OqQyLlrd93q4z+tVZ9G0LnXVCyXdw5/cBMf7uaga+uQwLxIT6gYqlHzZLl5KwNcs7ZljOT6UmYznkp+JFaIhjMRqM+ac/72aljDsR+/z9GqkTYk8uRTnex+rVIszIMfOSfamB//2apR82S5eSsDXLO2ZYzk+lJmM//Y/+0O2lBob3Rvc2hvcCAzLjAAOEJJTQPtClJlc29sdXRpb24AAAAAEABIAAAAAQACAEgAAAABAAI4QklNBA0YRlggR2xvYmFsIExpZ2h0aW5nIEFuZ2xlAAAAAAQAAAAeOEJJTQQZEkZYIEdsb2JhbCBBbHRpdHVkZQAAAAAEAAAAHjhCSU0D8wtQcmludCBGbGFncwAAAAkAAAAAAAAAAAEAOEJJTQQKDkNvcHlyaWdodCBGbGFnAAAAAAEAADhCSU0nEBRKYXBhbmVzZSBQcmludCBGbGFncwAAAAAKAAEAAAAAAAAAAjhCSU0D9RdDb2xvciBIYWxmdG9uZSBTZXR0aW5ncwAAAEgAL2ZmAAEAbGZmAAYAAAAAAAEAL2ZmAAEAoZmaAAYAAAAAAAEAMgAAAAEAWgAAAAYAAAAAAAEANQAAAAEALQAAAAYAAAAAAAE4QklNA/gXQ29sb3IgVHJhbnNmZXIgU2V0dGluZ3MAAABwAAD/////////////////////////////A+gAAAAA/////////////////////////////wPoAAAAAP////////////////////////////8D6AAAAAD/////////////////////////////A+gAADhCSU0ECAZHdWlkZXMAAAAAEAAAAAEAAAJAAAACQAAAAAA4QklNBB4NVVJMIG92ZXJyaWRlcwAAAAQAAAAAOEJJTQQaBlNsaWNlcwAAAAB3AAAABgAAAAAAAAAAAAAAWgAAAHgAAAALAG8AcABlAHIAYQBfAGgAbwB1AHMAZQAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAeAAAAFoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOEJJTQQREUlDQyBVbnRhZ2dlZCBGbGFnAAAAAQEAOEJJTQQUF0xheWVyIElEIEdlbmVyYXRvciBCYXNlAAAABAAAAAE4QklNBAwVTmV3IFdpbmRvd3MgVGh1bWJuYWlsAAALLwAAAAEAAABwAAAAVAAAAVAAAG5AAAALEwAYAAH/2P/gABBKRklGAAECAQBIAEgAAP/uAA5BZG9iZQBkgAAAAAH/2wCEAAwICAgJCAwJCQwRCwoLERUPDAwPFRgTExUTExgRDAwMDAwMEQwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwBDQsLDQ4NEA4OEBQODg4UFA4ODg4UEQwMDAwMEREMDAwMDAwRDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDP/AABEIAFQAcAMBIgACEQEDEQH/3QAEAAf/xAE/AAABBQEBAQEBAQAAAAAAAAADAAECBAUGBwgJCgsBAAEFAQEBAQEBAAAAAAAAAAEAAgMEBQYHCAkKCxAAAQQBAwIEAgUHBggFAwwzAQACEQMEIRIxBUFRYRMicYEyBhSRobFCIyQVUsFiMzRygtFDByWSU/Dh8WNzNRaisoMmRJNUZEXCo3Q2F9JV4mXys4TD03Xj80YnlKSFtJXE1OT0pbXF1eX1VmZ2hpamtsbW5vY3R1dnd4eXp7fH1+f3EQACAgECBAQDBAUGBwcGBTUBAAIRAyExEgRBUWFxIhMFMoGRFKGxQiPBUtHwMyRi4XKCkkNTFWNzNPElBhaisoMHJjXC0kSTVKMXZEVVNnRl4vKzhMPTdePzRpSkhbSVxNTk9KW1xdXl9VZmdoaWprbG1ub2JzdHV2d3h5ent8f/2gAMAwEAAhEDEQA/AOmAU2VPf9ETHJSDURr7GCG6BaJJ6NMeKJzdpjwTahTMkkn5pnTGunx0SvZHdKKcoMDw0lrhIjXRRrrdZu1gjkHlX2yK2DwaPyKFjQ/nQ/vDlVvvGpsDzDY9nQUT5FoPBa6FGXcSiW1uY4h2s8HxTPrex217S13gdFZiYkDY2wGwTvo2an1VMiQh5F1VjdsSeyBCUICAu7KuM1VMITQiEJoT7WMNqbapwlCNqf/Q6sBTZW95hgkjUplZxPovI5JA+5Xck+GJLVhHikAiZjWCxu8DbMnVWbX+09/xTmAQO5/ImcNCfAKpPIZ1daNiEBG66snlrWD4D8iC53igesXAGeQITbydBr5JlrkhcJDiNxaQ4D4K48V31gO9zHag9xPcKqzGfAdZpOjWjklHawVAMBkfx5KVnTwVQa4wXk+54A7dynODW1pc63Y1oLnvdDWtaBue97ifaxjfpK0NeFx3+Md/1it6fX03peHc/DySPtmXUN8ydteJtq3W11bvfc9zP0v80pffyfvfgFnsw7Ovi5VGZQ3KxiXY9hd6NhEb2NcWNu2/mtt272fyEWFHpODlMxG0WUfZKMcMpxhbHqvrYxodfbSwv9H1Ld/p1P8A0npfzv6RR631PovQMcX9UyjW5wmrHrAddZH+ipn/AMEs2VKwM8BEXLWtdGA4ZWaGl90kJQhYN1uVh05N1P2Z17fUFBO5zGO91LbXQz9N6Wx9vt9n82jwpQbAPdjqi//R6D6xX9Qx+n+r0p9NWRuaHeqN52nT9CyW/pGrnas3602YRZZ1U15DrRcLamBpDWtLPs3t/wAE/wDnLPalaMzJqpdl0323k7R7txpDnH9J6jj9Gpuz6KakZlVjab632jtkMaQyR+bcyT6Lv/An/mJZcspHSxFOPGIjWiXSwfrP1LG6Re/qbftnWatwoZWw7Lmy30f5oNbvb+k9T+bVKr/GcW2DG6p0v7K+0hm8Pe0N3e3dtsbY13P76Fdhm1hrc/IIJgu0a4T+axzam+z+V/4IqdJtN/2V1GW2qpz2G+xrHVbBP2d9T3U/ztm36DvoKMSOui4xHd62/qfT8PGORk5NdWPUIdYXAzHthjQdz3Pj2LGx/wDGNg02usdjUuxjGwjIAytv77qXsON7/wDRttVduIwmRZYSNTLav/edK2Mf03tNl++xtRa4MhrX+19x9Khrv0aQl4JMPF23/wCMD6tsZRkOdkuGRW6yqsVDeGjcLH2TZsb/ADbm/SVGz/Gf0h5Apw7yyRNll1LC3X6fpNdY93/FrPx8pt2TkUV1PaKNgNjmQHEn3Gt30XMYpWFja33C+6QC8MYWdtdjG+kXJcfgrg8Xrx1/o7Ayx+ZWGW1WXNM/mVAWW7o+g/Z9Gt300uk/WPpfV7jX019zrGNFjvUpfUdjtGmsv/nNzv3Fy13S3041Vue4ltx/mTZVc2RB22Nqr/N3LPtycnp4fZgMymWAij7NW4hz2Wbv0mM/32VtRBO1I4eoL0H1w+u/7GZZhdJr+09Qb7brtu6nGJ/NsI9luV/wX0Kv8KvOul+n1P6wY9vX8hxquuD8vJvl5cGje2l+jttdzw2r9yqtWG4+O3Edl2dKvrq3loabbd5MbnvcyPo7js9T8+z/AItV2ZWDW8XO6blBp9zQXOLYafcR6gc16cCQQaWEWKt9iIL/AHghweNwc2C0g67mub7dqbYV5vifWTIxqaqsa+7Bqa8PrxcmpzWF8+r7bqf55tn+Eru9Nlq1/wDnn1+gzk4+PY0Qfax7ZB/PZayx9StDmY9QQ1zy8uhBf//SC/pmKPoOIJ7Ne7+9MOnVNH85aB4ixytuDWHbMHwCeAAZPPYj+KsSxw/dH2NeM5dz9rXHTTGl14/tlI4FjSP1rI8hvn8FbDARMRroSf4Byk3cCQWkjsY5CiOOPYMgnLuWj9iuDdMy6PEkEf8AUqIx8sGRnWgdx7T/AN9WkS3ktOneFGAHTB1TeCPZdxy7uZkYXUrdhZ1S1gHGgjy42qpZ0jrTy6OruI7BzT+UPW+Tydp2nvIj/NTzXzHuHiATHyThCKDOXd5odE6wyNnUmeGrXAfDlMenfWMBv+UK3bRDY3cf5hXSOuLCP0YduMl2g/6MlRc2ppLgzbPYnUf2DuR9sI9yXd5l+P8AWVp3DMa4wRydPL3M9qGLPrQ1wAu3RwHODm/9L81dHZsk7WwSBogOaOQ2T3AMpwwx8VpzScYH63kfzm4Dgeo0/wDVOSFv1tYI2jaeRLII/lAXLcZu2CA4eIOhUgNCdr4/OiSnfd4eP4f96t+8T8H/05PZkB28OboPzi7/AL6p1OJEz8Cf9qC4vBEPY13jAJj71HZlfmPZH9Uz+VWZFrC240tPmR2EGfkkHMaQBo4nUOEx+IVXfcwAWmrXncQD9wCT8qn6IDNwGo2kg/cmEWuum4TYCI2OB8AZ/wCqc1DLniR7te7SQNP5YZ7VUD73O2iljmd/T0Mf5zXf9FGDrhpWAHRoHgx83Nc5NqlwNsn5uMyA+yHd9Hc+b9j0qs3FfoHbxoZa0kT/AJqGLuonSxrXDuGz/wBUXKX2jJA1phvYOg/IJwH8rWkn+QZzjuJdIYXcgkA6eA9Ru1QYamglu93jALv836X/AFSTb8h3/aQx5QP+qTWixxaHVWb+4B0H4ohHl+SxdU7hrpI5cDz/AGoQvdOjRH3H7lElu73bh81DfXJDXAHydJ/KpAsJbQIiCSPiRP4p2BocXAy7xMfwQCS0Ai+Y/N3NEfDcFJj73HVu8eHt/wC+7U+1r//UGz0tvs/nO+6N0/20x+3bvZt2x7d0fjuXl6SsS2aw3/g+qV/bJHq7Nvlz89ym7kT6cfPn+wvKElGN/wDvWQ7f98+rH7Rr6e3nSP8AzJB/WIHr7v8Arcx5bvzti8vSTvs/7pb9v7H039N6b9vq+XO3+xv/ADkAftLc3Z9q/wCjt+Xqe1ecpIlH2vp1vrbB9t3bZ1mN3/R/QquPT3D0/V2eUxH/AFK85STo/RbL6/V9Lb638rbP50Qmd6kGfS51mV5qknrX0+v0tv5v9nd/FPp+bO3vG3/0Z7l5ekih/9kAOEJJTQQhGlZlcnNpb24gY29tcGF0aWJpbGl0eSBpbmZvAAAAAFUAAAABAQAAAA8AQQBkAG8AYgBlACAAUABoAG8AdABvAHMAaABvAHAAAAATAEEAZABvAGIAZQAgAFAAaABvAHQAbwBzAGgAbwBwACAANgAuADAAAAABADhCSU0EBgxKUEVHIFF1YWxpdHkAAAAAB//+AAAAAQEA/+4ADkFkb2JlAGSAAAAAAf/bAIQAFBERGhIaKRgYKTMnICczJxwcHBwnIhcXFxcXIhEMDAwMDAwRDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAEVGhohHSEiGBgiFA4ODhQUDg4ODhQRDAwMDAwREQwMDAwMDBEMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwM/8AAEQgAWgB4AwEiAAIRAQMRAf/dAAQACP/EARsAAAMBAQEBAQEBAQEAAAAAAAEAAgMEBQYHCAkKCwEBAQEBAQEBAQEBAQEAAAAAAAECAwQFBgcICQoLEAACAgEDAgMEBwYDAwYCATUBAAIRAyESMQRBUSITYXEygZGxQqEF0cEU8FIjcjNi4YLxQzSSorIV0lMkc8JjBoOT4vKjRFRkJTVFFiZ0NlVls4TD03Xj80aUpIW0lcTU5PSltcXV5fVWZnaGlqa2xtbm9hEAAgIABQEGBgEDAQMFAwYvAAERAiEDMUESUWFxgZEiEzLwobEEwdHh8UJSI2JyFJIzgkMkorI0U0Rjc8LSg5OjVOLyBRUlBhYmNWRFVTZ0ZbOEw9N14/NGlKSFtJXE1OT0pbXF1eX1VmZ2hv/aAAwDAQACEQMRAD8A9dIiTwoDYJi+o85BjSGibVoDGMjqFN3RdsOgbIvl5O8M6Kso5pRIYt2yRPycqd1cow8CoanV33gPMrWpCcFZCJcOdNIaiApFNUtNITSppUD/0PaSrpiGtvpbhScEpcGdF32gCmigvG1pOqrAwAAQSyZVoxucGiyWsVAEON3w6RgQbUgGTF3j9DIwyL0WrtXaRjijlnD04mUiAByw+L1f4kOt6uOCEqwYzuyS+zOWP/31ifcx/wA2InEGiLelbTqZtWNCVay7cETPJIRiO8izCQnESHBFu009DDTQqmlaQ//R9bqs8elh6kgSP8IeDH+MmUZShilYraJfbXP1ks8KiAI9/wDE82OYlpwfB1a+yJWu7PV6L8Tj1tjaYGHxCTcfxXpJGvUA/qEovjysWQDfjfxPBLpISu47SNfJJ5ybg+p9SMyZRIMTwQ55epxYK9WQjfD5GCWXBAQjZA/i2f8AbcJdNOUjMynuPe4KRB9Thy4px3YpCQ8Ync2ckMY88gP6jtfk49NGN5BM2QYk2xL8Ph2s1/T/AO/VIg+rx9RjykjHKMq/gludgbflMEJdLLdCwT7YNZo5swAlI7QTLbu/i/8AKmFSIPo/2TD6nqbI7/4trxfif4xi/Dxt+LKeIfw/+PfNH4hk6bp/Rx0JjieSXwx/9+PiT6eWQ7pGJJ5lu+JskOnpZZvxjqonMbjHzyj9iMY/7v8A8yP1z8b0ccvTz3wkIn2S+J9+P4vGNDLEg/bl/wDAnrSyRztVs9OleWH4n009BOv6gVevJdTnxZ//0sSCAImAoeBWRMzZhqOPM9BJPKu3RGFdmXqS7wP0uOSEMkt08crHte0Jq3PE1yOYZa+zJP7QB9mX0PTtZMXPEvI4JjHKO0idXu0QevgNdsg+iIrsbxHI82H4nCE9+3cRp5wjJ+JY8hJmDR+yH0vT91olgHgD8m8ScjxcuTps/wAYkaG0fv6TOWXTZQBUogaAD/40+ueniR8I+hyl00DzEfQ3iycjyPR6Q95gfv8A+UnaEsGPSE5iP8JO+P8A7rez9kx3rEN/smH+FvBk5o5Tl6aX2iFen9ixfw/eVXtsvNH/06J1oNA+DBjE9liaezOKNBomrLIl4JJLk0VXtQdGdDoQgHwclLGq34MkS7EfNz/mX2+9pDY252Y66tDepvwpoBd6uZtJmfH7mTO3SMsFW1TAIDYmPEOkZDEX3VIKtB//1J0lwLX04ns19l55c93qzkb+mBxakyHA+lxj/qeg/P5MGBnsMvY3t2jU2svm49+6YRcowJ5+9aA03UiXbhwyc9vmgdIG74ZLu2nWX3PHj57fJ6u3b/V8TQEzB+0iz73Lx4SP3pqMlX4hom+AQx37uw4/N0QmMfaqnnsqB//Z"> + <animate attributeName="y" from="5" to="145" begin="100" dur="3" fill="freeze"/> + </image> + </defs> + <!-- END OF DEFS--> + + <!-- ACTUAL TEST CONTENT--> + <use xlink:href="#lineID"> + <animate attributeName="x" from="10" to="70" begin="100" dur="3" fill="freeze"/> + </use> + + <use xlink:href="#rectID" transform=""> + <animateTransform attributeName="transform" type="translate" from="0 0" to="140 0" begin="100" dur="3" fill="freeze"/> + <animateTransform attributeName="transform" type="scale" from="1 1" to="0.5 1" begin="100" dur="3" additive="sum" fill="freeze"/> + </use> + + <use xlink:href="#circleID"> + <animate attributeName="x" from="10" to="70" begin="100" dur="3" fill="freeze"/> + </use> + + <use xlink:href="#polylineID" transform=""> + <animateTransform attributeName="transform" type="rotate" from="0" to="15" additive="sum" begin="100" dur="3" fill="freeze"/> + </use> + + <use x="60" y="-10" xlink:href="#polygonID" transform=""> + <animateMotion path="M 0 0 l 0 150" begin="100" dur="3" fill="freeze"/> + <animateTransform attributeName="transform" type="scale" from="1 1" to="1 2" begin="100" dur="3" additive="sum" fill="freeze"/> + </use> + + <use xlink:href="#imageID" transform=""> + <animateTransform attributeName="transform" type="scale" from="1 .25" to="1 1" begin="100" dur="3" additive="sum" fill="freeze"/> + </use> + <!-- END OF ACTUAL TEST CONTENT--> + </g> + + <text id="revision" x="10" y="340" font-size="40" stroke="none" fill="black">$Revision: 1.6 $</text> + <rect id="test-frame" x="1" y="1" width="478" height="358" fill="none" stroke="#000000"/> +</svg> diff --git a/dom/smil/crashtests/523188-1.svg b/dom/smil/crashtests/523188-1.svg new file mode 100644 index 0000000000..c03cea4923 --- /dev/null +++ b/dom/smil/crashtests/523188-1.svg @@ -0,0 +1,15 @@ +<?xml version="1.0"?> +<svg xmlns="http://www.w3.org/2000/svg" + class="reftest-wait" + onload="setTimeout(removeNode, 0)"> + <script> + function removeNode() { + var node = document.getElementById("myRect"); + node.parentNode.removeChild(node); + document.documentElement.removeAttribute("class"); + } + </script> + <rect id="myRect" x="20" y="20" height="50" width="50" stroke="blue"> + <animate attributeName="stroke-width" from="1" to="9" begin="0s" dur="2s"/> + </rect> +</svg> diff --git a/dom/smil/crashtests/525099-1.svg b/dom/smil/crashtests/525099-1.svg new file mode 100644 index 0000000000..8eed11489a --- /dev/null +++ b/dom/smil/crashtests/525099-1.svg @@ -0,0 +1,7 @@ +<?xml version="1.0"?> +<svg xmlns="http://www.w3.org/2000/svg"> + <rect x="20" y="20" height="50" width="50" fill="blue"> + <animate attributeName="display" by="inline" + begin="0s" dur="1s"/> + </rect> +</svg> diff --git a/dom/smil/crashtests/526536-1.svg b/dom/smil/crashtests/526536-1.svg new file mode 100644 index 0000000000..4fcf35d081 --- /dev/null +++ b/dom/smil/crashtests/526536-1.svg @@ -0,0 +1,19 @@ +<svg xmlns="http://www.w3.org/2000/svg" + class="reftest-wait" + onload="setTimeout('boom()', 0)"> +<script type="text/javascript"> +<![CDATA[ +function boom() +{ + document.getElementById("anim").setAttribute("fill", "freeze"); + document.documentElement.removeAttribute("class"); +} +]]> +</script> + <g transform="translate(50 50)"> + <circle r="40" style="fill: yellow; stroke: black; stroke-width: 1"> + <animate id="anim" attributeName="cx" attributeType="XML" + values="0; 200" dur="2s" begin="-1s" repeatCount="0.5"/> + </circle> + </g> +</svg> diff --git a/dom/smil/crashtests/526875-1.svg b/dom/smil/crashtests/526875-1.svg new file mode 100644 index 0000000000..281454bf61 --- /dev/null +++ b/dom/smil/crashtests/526875-1.svg @@ -0,0 +1,4 @@ +<?xml version="1.0"?> +<svg xmlns="http://www.w3.org/2000/svg"> + <animate attributeName="fill-opacity" by="-1"/> +</svg> diff --git a/dom/smil/crashtests/526875-2.svg b/dom/smil/crashtests/526875-2.svg new file mode 100644 index 0000000000..73c229da5f --- /dev/null +++ b/dom/smil/crashtests/526875-2.svg @@ -0,0 +1,4 @@ +<?xml version="1.0"?> +<svg xmlns="http://www.w3.org/2000/svg"> + <animate attributeName="fill-opacity" by="1"/> +</svg> diff --git a/dom/smil/crashtests/529387-1-helper.svg b/dom/smil/crashtests/529387-1-helper.svg new file mode 100644 index 0000000000..7885ab71fd --- /dev/null +++ b/dom/smil/crashtests/529387-1-helper.svg @@ -0,0 +1,5 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <text y="20pt">abc + <animate attributeName="opacity" from="1" to="0" begin="0s" dur="2s"/> + </text> +</svg> diff --git a/dom/smil/crashtests/529387-1.xhtml b/dom/smil/crashtests/529387-1.xhtml new file mode 100644 index 0000000000..de3dbec34c --- /dev/null +++ b/dom/smil/crashtests/529387-1.xhtml @@ -0,0 +1,7 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> + <script> + var p = new XMLHttpRequest(); + p.open("GET", "529387-1-helper.svg", false); + p.send(); + </script> +</html> diff --git a/dom/smil/crashtests/531550-1.svg b/dom/smil/crashtests/531550-1.svg new file mode 100644 index 0000000000..306f41702d --- /dev/null +++ b/dom/smil/crashtests/531550-1.svg @@ -0,0 +1,3 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <g><animateTransform attributeName="transform" by="1"/></g> +</svg> diff --git a/dom/smil/crashtests/541297-1.svg b/dom/smil/crashtests/541297-1.svg new file mode 100644 index 0000000000..4268232ba1 --- /dev/null +++ b/dom/smil/crashtests/541297-1.svg @@ -0,0 +1,22 @@ +<?xml version="1.0" encoding="UTF-8"?> +<svg xmlns="http://www.w3.org/2000/svg"><svg id="w"><animate/></svg><script type="text/javascript"> +<![CDATA[ + +function boom() +{ + anim = document.createElementNS("http://www.w3.org/2000/svg", "animate"); + document.documentElement.appendChild(anim); + document.documentElement.removeChild(anim); + + setTimeout(t, 0); + + function t() + { + document.getElementById("w").appendChild(anim); + } +} + +window.addEventListener("load", boom, false); + +]]> +</script></svg> diff --git a/dom/smil/crashtests/547333-1.svg b/dom/smil/crashtests/547333-1.svg new file mode 100644 index 0000000000..bac629b493 --- /dev/null +++ b/dom/smil/crashtests/547333-1.svg @@ -0,0 +1,22 @@ +<?xml version="1.0"?> +<svg xmlns="http://www.w3.org/2000/svg" + class="reftest-wait"> +<script type="text/javascript"> +<![CDATA[ + +function boom() +{ + document.getElementsByTagName("animate")[0].setAttributeNS(null, "attributeName", "font-size"); + document.getElementsByTagName("text")[0].setAttributeNS(null, "fill", "green"); + document.documentElement.removeAttributeNS(null, "x"); + document.documentElement.removeAttribute("class"); +} + +window.addEventListener("load", boom, false); + +]]> +</script> + +<text>abc<animate/></text> + +</svg> diff --git a/dom/smil/crashtests/548899-1.svg b/dom/smil/crashtests/548899-1.svg new file mode 100644 index 0000000000..c12ed27454 --- /dev/null +++ b/dom/smil/crashtests/548899-1.svg @@ -0,0 +1,14 @@ +<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:xlink="http://www.w3.org/1999/xlink">
+ <defs>
+ <circle id="circleID" cx="20" cy="100" r="10" fill="orange" stroke="black">
+ <animateTransform attributeName="transform" type="scale"
+ from="1" to="2" begin="0" dur="3"/>
+ </circle>
+ <rect id="rectID" fill="green" stroke="black" height="100" width="100">
+ <animate attributeName="fill" from="white" to="blue" begin="0" dur="3"/>
+ </rect>
+ </defs>
+ <use xlink:href="#circleID"/>
+</svg>
diff --git a/dom/smil/crashtests/551620-1.svg b/dom/smil/crashtests/551620-1.svg new file mode 100644 index 0000000000..2ea83e9c29 --- /dev/null +++ b/dom/smil/crashtests/551620-1.svg @@ -0,0 +1,21 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<animate id="x" begin="y.end"/> +<animate id="y"/> + +<script> + +function boom() +{ + var x = document.getElementById("x"); + var y = document.getElementById("y"); + y.appendChild(x); + y.setAttributeNS(null, "dur", "0.5s"); + y.removeAttributeNS(null, "dur"); +} + +window.addEventListener("load", boom, false); + +</script> + +</svg> diff --git a/dom/smil/crashtests/554141-1.svg b/dom/smil/crashtests/554141-1.svg new file mode 100644 index 0000000000..61ce419f53 --- /dev/null +++ b/dom/smil/crashtests/554141-1.svg @@ -0,0 +1,12 @@ +<svg xmlns="http://www.w3.org/2000/svg" + onload=" + document.documentElement.pauseAnimations(); + document.documentElement.setCurrentTime(0); + document.getElementById('b').removeAttribute('begin'); + document.getElementById('a').setAttribute('dur', '1s')"> + <rect> + <animate attributeName="y" attributeType="XML" id="a"/> + <animate attributeName="fill" attributeType="CSS" id="b" + begin="a.end" dur="2s"/> + </rect> +</svg> diff --git a/dom/smil/crashtests/554202-2.svg b/dom/smil/crashtests/554202-2.svg new file mode 100644 index 0000000000..a3bbb3195c --- /dev/null +++ b/dom/smil/crashtests/554202-2.svg @@ -0,0 +1,19 @@ +<svg xmlns="http://www.w3.org/2000/svg" + onload=" + document.documentElement.pauseAnimations(); + document.documentElement.setCurrentTime(0); + document.getElementById('a').beginElementAt(1); + document.documentElement.setCurrentTime(2)"> + <!-- + This test case sets up a cycle between simultaneous instance times such that + when the instance times are sorted if this cycle is not detected we will + crash. + --> + <rect width="100" height="100" fill="red"> + <set attributeName="fill" to="blue" begin="a.begin" dur="4s"/> + <set attributeName="fill" to="green" id="a" + begin="b.begin; 3s" dur="4s"/> + <set attributeName="fill" to="red" id="b" + begin="a.begin" dur="4s"/> + </rect> +</svg> diff --git a/dom/smil/crashtests/555026-1.svg b/dom/smil/crashtests/555026-1.svg new file mode 100644 index 0000000000..76b4cf0756 --- /dev/null +++ b/dom/smil/crashtests/555026-1.svg @@ -0,0 +1,25 @@ +<?xml version="1.0"?> +<svg xmlns="http://www.w3.org/2000/svg" + class="reftest-wait" + onload="go()"> + <script> + function go() { + // setCurrentTime to force a sample + document.documentElement.setCurrentTime(1); + document.documentElement.removeAttribute("class"); + } + </script> + <rect id="myRect" fill="blue" height="40" width="40"> + <!-- The "keyTimes" values below are invalid, but they should be ignored + (and definitely shouldn't trigger any assertion failures) since we're + in paced calcMode. --> + <animate attributeName="x" by="50" calcMode="paced" dur="2s" + keyTimes="0; -1"/> + <animate attributeName="x" by="50" calcMode="paced" dur="2s" + keyTimes=""/> + <animate attributeName="x" by="50" calcMode="paced" dur="2s" + keyTimes="abc"/> + <animate attributeName="x" by="50" calcMode="paced" dur="2s" + keyTimes="5"/> + </rect> +</svg> diff --git a/dom/smil/crashtests/556841-1.svg b/dom/smil/crashtests/556841-1.svg new file mode 100644 index 0000000000..92712deaa9 --- /dev/null +++ b/dom/smil/crashtests/556841-1.svg @@ -0,0 +1,16 @@ +<?xml version="1.0"?> +<svg xmlns="http://www.w3.org/2000/svg" + class="reftest-wait" + onload="go()"> + <script> + function go() { + // setCurrentTime to force a sample + document.documentElement.setCurrentTime(2); + document.documentElement.removeAttribute("class"); + } + </script> + <rect fill="teal" x="50" y="50" width="20" height="20"> + <animateTransform attributeName="transform" type="rotate" by="30" + calcMode="paced" dur="4s"/> + </rect> +</svg> diff --git a/dom/smil/crashtests/572938-1.svg b/dom/smil/crashtests/572938-1.svg new file mode 100644 index 0000000000..d759944c7d --- /dev/null +++ b/dom/smil/crashtests/572938-1.svg @@ -0,0 +1,12 @@ +<svg xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink"> + <defs> + <text id="myText">Used Text Element + <set attributeName="display" to="none"/> + </text> + </defs> + <use xlink:href="#myText" x="20" y="40"/> + <text x="20" y="60">Normal Text Element + <set attributeName="display" to="none"/> + </text> +</svg> diff --git a/dom/smil/crashtests/572938-2.svg b/dom/smil/crashtests/572938-2.svg new file mode 100644 index 0000000000..8b9cf7b70e --- /dev/null +++ b/dom/smil/crashtests/572938-2.svg @@ -0,0 +1,22 @@ +<svg xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink" + class="reftest-wait"> + + <script> + function boom() + { + document.getElementById("circleID").removeChild( + document.getElementById("at")); + document.documentElement.removeAttribute("class"); + } + window.addEventListener("load", boom, false); + </script> + + <circle id="circleID"> + <animate/> + <animateTransform id="at" attributeName="transform"/> + </circle> + <animate attributeName="stroke-width"/> + <use xlink:href="#circleID"/> + +</svg> diff --git a/dom/smil/crashtests/572938-3.svg b/dom/smil/crashtests/572938-3.svg new file mode 100644 index 0000000000..642ad32fba --- /dev/null +++ b/dom/smil/crashtests/572938-3.svg @@ -0,0 +1,10 @@ +<svg xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink"> + <defs> + <text id="a">Text A</text> + <text id="b">Text B</text> + </defs> + <use xlink:href="#a" x="20" y="40"> + <set attributeName="xlink:href" to="#b" dur="2s"/> + </use> +</svg> diff --git a/dom/smil/crashtests/572938-4.svg b/dom/smil/crashtests/572938-4.svg new file mode 100644 index 0000000000..549d43dd62 --- /dev/null +++ b/dom/smil/crashtests/572938-4.svg @@ -0,0 +1,10 @@ +<svg xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink"> +<g id="a"> + <path d=""><animate/></path> +</g> +<g display="none"> +<use xlink:href="#a" x="80"/> +<set attributeName="display" to="inline"/> +</g> +</svg> diff --git a/dom/smil/crashtests/588287-1.svg b/dom/smil/crashtests/588287-1.svg new file mode 100644 index 0000000000..cc35cf6b46 --- /dev/null +++ b/dom/smil/crashtests/588287-1.svg @@ -0,0 +1,24 @@ +<?xml version="1.0"?> +<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait"> +<script> + +function boom() +{ + var animate = document.createElementNS("http://www.w3.org/2000/svg", "animate"); + animate.setAttributeNS(null, "begin", "0.5s"); + document.documentElement.appendChild(animate); + + setTimeout(function() { + var g = document.createElement("g"); + var svg = document.createElementNS("http://www.w3.org/2000/svg", "svg"); + g.appendChild(svg); + document.documentElement.appendChild(g); + svg.appendChild(animate); + document.documentElement.removeAttribute("class"); + }, 400); +} + +window.addEventListener("load", function() { setTimeout(boom, 200) }, false); + +</script> +</svg> diff --git a/dom/smil/crashtests/588287-2.svg b/dom/smil/crashtests/588287-2.svg new file mode 100644 index 0000000000..70d8e76391 --- /dev/null +++ b/dom/smil/crashtests/588287-2.svg @@ -0,0 +1,26 @@ +<?xml version="1.0"?> +<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait"> +<script> + +function boom() +{ + var animate = document.createElementNS("http://www.w3.org/2000/svg", "animate"); + animate.setAttributeNS(null, "begin", "0.5s"); + document.documentElement.appendChild(animate); + + setTimeout(function() { + var g = document.createElement("g"); + var svg = document.createElementNS("http://www.w3.org/2000/svg", "svg"); + g.appendChild(svg); + document.documentElement.appendChild(g); + svg.setCurrentTime(0.2); + svg.appendChild(animate); + svg.setCurrentTime(0.0); // Trigger backwards seek + document.documentElement.removeAttribute("class"); + }, 400); +} + +window.addEventListener("load", function() { setTimeout(boom, 200) }, false); + +</script> +</svg> diff --git a/dom/smil/crashtests/590425-1.html b/dom/smil/crashtests/590425-1.html new file mode 100644 index 0000000000..906d348db2 --- /dev/null +++ b/dom/smil/crashtests/590425-1.html @@ -0,0 +1,24 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<head> +<script> + +function boom() +{ + var frame = document.getElementById("frame") + var frameSVG = frame.contentDocument.getElementById('s'); + var animate = frame.contentDocument.createElementNS("http://www.w3.org/2000/svg", "animate"); + frame.remove(); + frameSVG.appendChild(animate); + document.documentElement.removeAttribute("class"); +} + +</script> +</head> + +<body onload="boom()"> + +<iframe id="frame" srcdoc="<body><svg id=s>"></iframe> + +</body> +</html> diff --git a/dom/smil/crashtests/594653-1.svg b/dom/smil/crashtests/594653-1.svg new file mode 100644 index 0000000000..76352ce30b --- /dev/null +++ b/dom/smil/crashtests/594653-1.svg @@ -0,0 +1,26 @@ +<?xml version="1.0"?> + +<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait"> +<script> +<![CDATA[ + +window.addEventListener("load", boom, false); + +function boom() +{ + setTimeout(bang, 0); +} + +function bang() +{ + document.documentElement.setCurrentTime(0); + document.documentElement.removeAttribute("class"); +} + +]]> +</script> + +<animate id="b"/> +<animate end="b.end"/> + +</svg> diff --git a/dom/smil/crashtests/596796-1.svg b/dom/smil/crashtests/596796-1.svg new file mode 100644 index 0000000000..52a66fd582 --- /dev/null +++ b/dom/smil/crashtests/596796-1.svg @@ -0,0 +1,15 @@ +<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait"> + +<script> +function boom() +{ + document.documentElement.appendChild(document.getElementById("a")); + document.documentElement.removeAttribute("class"); +} + +window.addEventListener("load", boom, false); +</script> + +<animate end="a.begin" id="a"/> + +</svg> diff --git a/dom/smil/crashtests/605345-1.svg b/dom/smil/crashtests/605345-1.svg new file mode 100644 index 0000000000..94887cf713 --- /dev/null +++ b/dom/smil/crashtests/605345-1.svg @@ -0,0 +1,25 @@ +<?xml version="1.0"?> +<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait"> +<script> +<![CDATA[ + +function boom() +{ + var anim = document.getElementById("a"); + var newSvg = document.createElementNS("http://www.w3.org/2000/svg", "svg"); + var oldSvg = document.removeChild(document.documentElement); + document.appendChild(newSvg); + document.removeChild(document.documentElement); + newSvg.pauseAnimations(); + document.appendChild(newSvg); + newSvg.appendChild(anim); + + oldSvg.removeAttribute("class"); +} + +window.addEventListener("load", function() { setTimeout(boom, 200); }, false); + +]]> +</script> +<animate id="a"/> +</svg> diff --git a/dom/smil/crashtests/606101-1.svg b/dom/smil/crashtests/606101-1.svg new file mode 100644 index 0000000000..988c86fa33 --- /dev/null +++ b/dom/smil/crashtests/606101-1.svg @@ -0,0 +1,23 @@ +<svg xmlns="http://www.w3.org/2000/svg" + class="reftest-wait"> +<script> + +function boom() +{ + var origSVG = document.documentElement; + + var a = document.createElementNS("http://www.w3.org/2000/svg", "animate"); + var g = document.createElementNS("http://www.w3.org/2000/svg", "g"); + var s = document.createElementNS("http://www.w3.org/2000/svg", "svg"); + document.removeChild(document.documentElement); + document.appendChild(g); + s.appendChild(a); + g.appendChild(s); + + origSVG.removeAttribute("class"); +} + +window.addEventListener("load", boom, false); + +</script> +</svg> diff --git a/dom/smil/crashtests/608295-1.html b/dom/smil/crashtests/608295-1.html new file mode 100644 index 0000000000..354e6f9099 --- /dev/null +++ b/dom/smil/crashtests/608295-1.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<head> +<script> + +function boom() +{ + // NB: <script src> is needed to trigger the bug. I'm being clever by also using it to remove reftest-wait. + var s = "<script src='data:text/javascript,parent.document.documentElement.className=null;'><\/script><svg>"; + document.getElementById("f").contentDocument.write(s); +} + +</script> +</head> +<body onload="boom();"> +<iframe id="f"></iframe> +</body> +</html> diff --git a/dom/smil/crashtests/608549-1.svg b/dom/smil/crashtests/608549-1.svg new file mode 100644 index 0000000000..dd441e0135 --- /dev/null +++ b/dom/smil/crashtests/608549-1.svg @@ -0,0 +1,29 @@ +<?xml version="1.0"?> +<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait"> +<script> +<![CDATA[ + +function boom() +{ + try { + document.getElementById("set").beginElementAt(NaN); + return; + } catch (e) {} + try { + document.getElementById("set").endElementAt(NaN); + return; + } catch (e) {} + + // If we got here we threw both exceptions and skipped both early-returns, as + // expected. + document.documentElement.removeAttribute("class"); +} + +window.addEventListener("load", boom, false); + +]]> +</script> + +<set id="set" attributeName="fill" to="green" begin="indefinite"/> + +</svg> diff --git a/dom/smil/crashtests/611927-1.svg b/dom/smil/crashtests/611927-1.svg new file mode 100644 index 0000000000..ea60f4ce1c --- /dev/null +++ b/dom/smil/crashtests/611927-1.svg @@ -0,0 +1,4 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <animate attributeName="stroke-width"/> + <animate attributeName="stroke-width" by="10em"/> +</svg> diff --git a/dom/smil/crashtests/615002-1.svg b/dom/smil/crashtests/615002-1.svg new file mode 100644 index 0000000000..eb9a293199 --- /dev/null +++ b/dom/smil/crashtests/615002-1.svg @@ -0,0 +1,16 @@ +<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait"> +<script> +function boom() +{ + var a = document.getElementById("a"); + a.removeAttribute('dur'); + document.documentElement.appendChild(a); + // Force a sample + document.documentElement.setCurrentTime(0); + document.documentElement.removeAttribute("class"); +} + +window.addEventListener("load", boom, false); +</script> +<animate begin="-2s" dur="2s" id="a"/> +</svg> diff --git a/dom/smil/crashtests/615872-1.svg b/dom/smil/crashtests/615872-1.svg new file mode 100644 index 0000000000..e0cdf21546 --- /dev/null +++ b/dom/smil/crashtests/615872-1.svg @@ -0,0 +1,21 @@ +<?xml version="1.0"?> + +<svg xmlns="http://www.w3.org/2000/svg"><script> +<![CDATA[ + +function boom() +{ + var r = document.documentElement; + var s = document.createElementNS("http://www.w3.org/2000/svg", "set"); + s.setAttributeNS(null, "begin", "1s"); + r.appendChild(s); + r.setCurrentTime(2); + document.removeChild(r); + r.setCurrentTime(0); + s.beginElementAt(0); +} + +window.addEventListener("load", boom, false); + +]]> +</script></svg> diff --git a/dom/smil/crashtests/641388-1.html b/dom/smil/crashtests/641388-1.html new file mode 100644 index 0000000000..25c941dedb --- /dev/null +++ b/dom/smil/crashtests/641388-1.html @@ -0,0 +1,97 @@ +<script>
+
+var ar = new Array(100000);
+
+function fill() {
+ var s = unescape("%ubeef%udead%udead%udead%u0000%u0000%u3030%u3030");
+ while(s.length < 0x40000) {
+ for(var x=0; x<100; x++) ar.push(s+s);
+ s+=s;
+ }
+}
+
+
+function gc() {
+ var evt = document.createEvent("Events");
+ evt.initEvent("please-gc", true, false);
+ document.dispatchEvent(evt);
+ fill();
+}
+
+
+gc();
+function start(){
+tmp = document.createElement('iframe');
+tmp.src="data:image/svg+xml,"+escape("<?xml version='1.0' standalone='no'?><!DOCTYPE svg><svg xmlns='http://www.w3.org/2000/svg'><defs id='element1'></defs><g id='element5'></g></svg>");
+tmp.id = 'ifr23282';
+try{document.getElementById('store_div').appendChild(tmp);}catch(e){}
+window.setTimeout('startrly()', 100);
+} function startrly() {
+try{o6=document.createComment(null);}catch(e){}
+try{o9=document.getElementById('ifr23282').contentDocument.documentElement;;}catch(e){}
+try{o13=document.getElementById('ifr23282').contentDocument.getElementById('element1');;}catch(e){}
+try{o15=document.getElementById('ifr23282').contentDocument.getElementById('element5');;}catch(e){}
+try{tmp = document.createElement('iframe');}catch(e){}
+try{tmp.id = 'ifr6690';}catch(e){}
+try{o6.ownerDocument.documentElement.appendChild(tmp);}catch(e){}
+window.setTimeout('start_dataiframe0()',100);
+} function start_dataiframe0(){
+try{o19=o6.ownerDocument.getElementById('ifr6690').contentDocument.documentElement;;}catch(e){}
+try{o24=document.createElementNS('http://www.w3.org/1998/Math/MathML','annotation-xml');;}catch(e){}
+try{o35=document.createElementNS('http://www.w3.org/1998/Math/MathML','emptyset');;}catch(e){}
+try{o40=o19.cloneNode(false);;}catch(e){}
+try{o19.appendChild(o13);}catch(e){}
+try{o19.appendChild(o15);}catch(e){}
+try{o24.appendChild(o40);}catch(e){}
+try{tmp = document.createElement('iframe');}catch(e){}
+tmp.src="data:text/html,<article%20id='element1'></article><command%20id='element3'></command>";
+try{tmp.id = 'ifr17516';}catch(e){}
+try{o13.ownerDocument.documentElement.appendChild(tmp);}catch(e){}
+window.setTimeout('start_dataiframe4()',100);
+} function start_dataiframe4(){
+try{o62=o13.ownerDocument.getElementById('ifr17516').contentDocument.getElementById('element1');;}catch(e){}
+try{tmp.id = 'ifr2522';}catch(e){}
+try{o101=o15.ownerDocument.getElementById('ifr2522').contentDocument.getElementById('element3');;}catch(e){}
+try{o101.appendChild(o24);}catch(e){}
+try{o112=document.createElementNS('http://www.w3.org/1999/xhtml', 'script');;}catch(e){}
+try{o124=document.createElementNS('http://www.w3.org/1998/Math/MathML','root');;}catch(e){}
+try{o125=document.createElementNS('http://www.w3.org/2000/svg','font-face');;}catch(e){}
+gc()
+try{o150=o40;}catch(e){}
+try{tmp.id = 'ifr44501';}catch(e){}
+try{o124.ownerDocument.documentElement.appendChild(tmp);}catch(e){}
+window.setTimeout('start_dataiframe7()',100);
+} function start_dataiframe7(){
+try{o152=o124.ownerDocument.getElementById('ifr44501').contentDocument.documentElement;;}catch(e){}
+try{tmp = document.createElement('iframe');}catch(e){}
+try{tmp.src="data:text/html,<div%20id='element1'></div>";}catch(e){}
+try{tmp.id = 'ifr55543';}catch(e){}
+try{o125.ownerDocument.documentElement.appendChild(tmp);}catch(e){}
+window.setTimeout('start_dataiframe10()',100);
+} function start_dataiframe10(){
+try{o198=o125.ownerDocument.getElementById('ifr55543').contentDocument.getElementById('element1');;}catch(e){}
+try{o152.appendChild(o101);}catch(e){}
+try{o152.ownerDocument.documentElement.appendChild(tmp);}catch(e){}
+window.setTimeout('start_dataiframe17()',100);
+} function start_dataiframe17(){
+try{o286=o152.ownerDocument.getElementById('ifr55543').contentDocument.documentElement;;}catch(e){}
+try{o288=o152.ownerDocument.getElementById('ifr55543').contentDocument.getElementById('element1');;}catch(e){}
+try{o349=document.createElementNS('http://www.w3.org/2000/svg','animate');;}catch(e){}
+try{o150.appendChild(o349);}catch(e){}
+try{o288.appendChild(o150);}catch(e){}
+try{o198.appendChild(o349);}catch(e){}
+window.setTimeout('start_dataiframe24()',100);
+} function start_dataiframe24(){
+try{o286.appendChild(o9);}catch(e){}
+try{o62.appendChild(o152);}catch(e){}
+try{o112.appendChild(o286);}catch(e){}
+try{o534=o35.cloneNode(false);;}catch(e){}
+gc();
+o35 = null;
+gc();
+window.setTimeout("fill()",300);
+}
+</script>
+<body onload="start()">
+<div id="store_div"></div>
+</body>
diff --git a/dom/smil/crashtests/641388-2.html b/dom/smil/crashtests/641388-2.html new file mode 100644 index 0000000000..f2ddead7e1 --- /dev/null +++ b/dom/smil/crashtests/641388-2.html @@ -0,0 +1,79 @@ +<script>
+function gc() {
+ var evt = document.createEvent("Events");
+ evt.initEvent("please-gc", true, false);
+ document.dispatchEvent(evt);
+ }
+var ar =new Array(100000);
+function fill() {
+ var s = unescape("%u0000%u0000%u3030%u3030");
+ while(s.length < 0x40000) {
+ for(var x=0; x<100; x++) ar.push(s+s);
+ s+=s;
+ }
+}
+
+
+function start(){
+tmp = document.createElement('iframe'); 'ifr16727';
+document.documentElement.appendChild(tmp);
+window.setTimeout('start_dataiframe0()',100);
+} function start_dataiframe0(){
+o20=document.createElement('iframe');
+tmp.id = 'ifr4446';;
+o68=o20;
+o101=document.getElementById('ifr4446').contentDocument.createElement('thead');;
+tmp.src="data:text/html," + escape("<html id='element0'><noscript id='element1'></html>");
+tmp.id = 'ifr49879';
+window.setTimeout('start_dataiframe6()',100);
+} function start_dataiframe6(){
+o104=document.getElementById('ifr49879').contentDocument.getElementById('element0');;
+o105=document.getElementById('ifr49879').contentDocument.getElementById('element1');;
+o120=document.getElementById('ifr49879').contentDocument.createElement('figure');;
+o105.appendChild(o120);
+o122=o105.lastElementChild;
+o140=document.getElementById('ifr49879').contentDocument.createElement('style');;
+o141=document.getElementById('ifr49879').contentDocument.createElementNS('http://www.w3.org/2000/svg','animate');;
+o151=o141.cloneNode(true);;
+tmp = document.createElement('iframe');
+tmp.src='data:text/html,%3Cform%20style%3B%27%20id%3D%27element3%27%3E%20%3Caside%20style%20id%3D%27element4%27%%3E';
+tmp.id = 'ifr13645';
+document.documentElement.appendChild(tmp);
+window.setTimeout('start_dataiframe8()',100);
+} function start_dataiframe8(){
+o154=document.getElementById('ifr13645').contentDocument.documentElement;;
+o158=document.getElementById('ifr13645').contentDocument.getElementById('element3');;
+o159=document.getElementById('ifr13645').contentDocument.getElementById('element4');;
+tmp.id = 'ifr17164';
+o120.ownerDocument.documentElement.appendChild(tmp);
+o171=o120.ownerDocument.getElementById('ifr17164').contentDocument.documentElement;;
+tmp = o158.ownerDocument.createElement('iframe');
+o101.appendChild(o151);
+o122.appendChild(o154);
+o68.appendChild(o171);
+o179=document.createElement('tbody');;
+o154.addEventListener('DOMNodeRemoved',function (event) { gc(); });
+tmp.src='data:text/html,%3Cs%27%20id%3D%27element0%27element4%27%3E%3Cs%20id%3D%27element5%27%20style%3D%27text-indent%3A%20-1%25%3Bmin-w%2C%20rgba%28255%2C0%2C0%2C0%29%20strict%3Bcolumn-count7element9%27%3E%s%3E';
+tmp.id = 'ifr35960';
+o154.ownerDocument.documentElement.appendChild(tmp);
+window.setTimeout('start_dataiframe13()',100);
+} function start_dataiframe13(){
+o217=o154.ownerDocument.getElementById('ifr35960').contentDocument.documentElement;;
+o218=o154.ownerDocument.getElementById('ifr35960').contentDocument.getElementById('element0');;
+o223=o154.ownerDocument.getElementById('ifr35960').contentDocument.getElementById('element5');;
+o223.appendChild(o101);
+o218.appendChild(o140);
+o140.appendChild(o151);
+o104.appendChild(o179);
+o230=o120.ownerDocument.getElementById('ifr17164').contentDocument.createElementNS('http://www.w3.org/2000/svg','svg');;
+window.setTimeout('start_dataiframe14()',100);
+} function start_dataiframe14(){
+gc();fill();
+o140.appendChild(o230);
+o171.appendChild(o104);
+o159.appendChild(o217);
+o158.appendChild(o218);
+}
+window.setTimeout("start()",100);
+</script>
+
diff --git a/dom/smil/crashtests/650732-1.svg b/dom/smil/crashtests/650732-1.svg new file mode 100644 index 0000000000..95be31c16a --- /dev/null +++ b/dom/smil/crashtests/650732-1.svg @@ -0,0 +1,46 @@ +<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait"> + <rect fill="green" width="100" height="100"> + <set id="a" attributeName="fill" to="blue" + begin="6s" end="986s"/> + <set id="b" attributeName="fill" to="orange" + begin="a.begin+69.3s;b.begin+700s" dur="700s" end="a.end"/> + <set id="c" attributeName="fill" to="yellow" + begin="0s;b.begin+700s"/> + </rect> + <script type="text/javascript"> +<![CDATA[ +const max_attempts = 100; +var attempts = 0; +function attemptCrash() +{ + remove(); + add(); + if (++attempts >= max_attempts) { + document.documentElement.removeAttribute("class"); + } else { + setTimeout(attemptCrash, 0); + } +} +function add() +{ + const svgns = "http://www.w3.org/2000/svg"; + var elem = document.createElementNS(svgns, "set"); + elem.setAttribute("id", "b"); + elem.setAttribute("attributeName", "fill"); + elem.setAttribute("to", "orange"); + elem.setAttribute("begin", "a.begin+69.3s;b.begin+700s"); + elem.setAttribute("dur", "700s"); + elem.setAttribute("end", "a.end"); + rect = document.getElementsByTagNameNS(svgns, "rect")[0]; + rect.appendChild(elem); +} +function remove() +{ + var elem = document.getElementById('b'); + elem.parentNode.removeChild(elem); + elem = null; +} +window.addEventListener("load", attemptCrash, false); +]]> + </script> +</svg> diff --git a/dom/smil/crashtests/665334-1.svg b/dom/smil/crashtests/665334-1.svg new file mode 100644 index 0000000000..94916d1e0e --- /dev/null +++ b/dom/smil/crashtests/665334-1.svg @@ -0,0 +1,13 @@ +<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait"> +<script> +function boom() +{ + // Remove the first 'a'. + document.documentElement.removeChild(document.getElementById("a")); + document.documentElement.removeAttribute("class"); +} +window.addEventListener("load", boom, false); +</script> +<animate id="a"/> +<animate id="a" end="a.begin" /> +</svg> diff --git a/dom/smil/crashtests/669225-1.svg b/dom/smil/crashtests/669225-1.svg new file mode 100644 index 0000000000..9660105631 --- /dev/null +++ b/dom/smil/crashtests/669225-1.svg @@ -0,0 +1,21 @@ +<?xml version="1.0"?> + +<svg xmlns="http://www.w3.org/2000/svg"> + +<script type="text/javascript"> +<![CDATA[ + +function boom() +{ + document.documentElement.appendChild(document.getElementById("a")); +} + +window.addEventListener("load", boom, false); + +]]> +</script> + +<animate end="a.begin" id="a"/> +<animate end="a.begin" id="a"/> + +</svg> diff --git a/dom/smil/crashtests/669225-2.svg b/dom/smil/crashtests/669225-2.svg new file mode 100644 index 0000000000..00d52c1f4c --- /dev/null +++ b/dom/smil/crashtests/669225-2.svg @@ -0,0 +1,21 @@ +<?xml version="1.0"?> + +<svg xmlns="http://www.w3.org/2000/svg"> + +<script type="text/javascript"> +<![CDATA[ + +function boom() +{ + var a = document.getElementById("a"); + a.removeAttribute("end"); + a.setAttribute("end", "a.begin"); +} + +window.addEventListener("load", boom, false); + +]]> +</script> + +<animate end="0" id="a" onend="boom()"/> +</svg> diff --git a/dom/smil/crashtests/670313-1.svg b/dom/smil/crashtests/670313-1.svg new file mode 100644 index 0000000000..97e12f35ac --- /dev/null +++ b/dom/smil/crashtests/670313-1.svg @@ -0,0 +1,20 @@ +<?xml version="1.0"?> +<svg xmlns="http://www.w3.org/2000/svg" + class="reftest-wait"> +<script type="text/javascript"> +<![CDATA[ + +function boom() +{ + try { + document.getElementById("x").beginElementAt(36028797018963970); + } catch (e) { } + document.documentElement.removeAttribute("class"); +} + +window.addEventListener("load", boom, false); + +]]> +</script> +<animate id="x" begin="a" /> +</svg> diff --git a/dom/smil/crashtests/678822-1.svg b/dom/smil/crashtests/678822-1.svg new file mode 100644 index 0000000000..a5e81ee10f --- /dev/null +++ b/dom/smil/crashtests/678822-1.svg @@ -0,0 +1,3 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <animate repeatCount="2" dur="1s" accumulate="1" /> +</svg> diff --git a/dom/smil/crashtests/678847-1.svg b/dom/smil/crashtests/678847-1.svg new file mode 100644 index 0000000000..1fa2718cbb --- /dev/null +++ b/dom/smil/crashtests/678847-1.svg @@ -0,0 +1,3 @@ +<svg xmlns="http://www.w3.org/2000/svg"> +<animate id="a" end="a.end+6s" /> +</svg> diff --git a/dom/smil/crashtests/678938-1.svg b/dom/smil/crashtests/678938-1.svg new file mode 100644 index 0000000000..f3f8308fa5 --- /dev/null +++ b/dom/smil/crashtests/678938-1.svg @@ -0,0 +1,11 @@ +<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait"> +<script> + window.addEventListener("load", function() { + setTimeout(function() { + document.documentElement.setCurrentTime(0); + document.documentElement.removeAttribute("class"); + }, 0); + }, false); +</script> +<set id="c"/><set id="b" begin="c.begin; b.begin"/> +</svg> diff --git a/dom/smil/crashtests/690994-1.svg b/dom/smil/crashtests/690994-1.svg new file mode 100644 index 0000000000..252fd2c264 --- /dev/null +++ b/dom/smil/crashtests/690994-1.svg @@ -0,0 +1,17 @@ +<?xml version="1.0"?> +<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait" onload="go()"> +<script> +<![CDATA[ +function go() { + document.documentElement.setCurrentTime(100); +} +function boom() +{ + document.documentElement.removeChild(document.getElementById("a")); + document.documentElement.removeAttribute("class"); +} +]]> +</script> +<animate id="a" begin="a.end; 99.9s" end="a.begin+0.2s" onend="boom()"/> +<animate id="a" begin="a.end; 99.9s" end="a.begin+0.2s"/> +</svg> diff --git a/dom/smil/crashtests/691337-1.svg b/dom/smil/crashtests/691337-1.svg new file mode 100644 index 0000000000..c341faa6b2 --- /dev/null +++ b/dom/smil/crashtests/691337-1.svg @@ -0,0 +1,8 @@ +<?xml version="1.0"?> +<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100"> + <rect width="100" height="100" fill="blue"> + <animate attributeName="fill" + begin="999999999999999999999999999999999999999999999999999999999999999999999999999999999" + dur="5s" from="blue" to="red" repeatCount="indefinite" additive="sum"/> + </rect> +</svg> diff --git a/dom/smil/crashtests/691337-2.svg b/dom/smil/crashtests/691337-2.svg new file mode 100644 index 0000000000..f4408ae5ee --- /dev/null +++ b/dom/smil/crashtests/691337-2.svg @@ -0,0 +1,11 @@ +<?xml version="1.0"?> +<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100"> + <rect width="100" height="100" fill="blue"> + <animate attributeName="fill" id="a" + begin="4999999999999999" dur="5s" from="blue" to="red" + repeatCount="indefinite" additive="sum"/> + <animate attributeName="fill" + begin="a.begin+4999999999999999" + dur="5s" from="blue" to="red" repeatCount="indefinite" additive="sum"/> + </rect> +</svg> diff --git a/dom/smil/crashtests/697640-1.svg b/dom/smil/crashtests/697640-1.svg new file mode 100644 index 0000000000..c2e1b89fdb --- /dev/null +++ b/dom/smil/crashtests/697640-1.svg @@ -0,0 +1,3 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <animate id="b" end="b.end" dur="3s" /> +</svg> diff --git a/dom/smil/crashtests/699325-1.svg b/dom/smil/crashtests/699325-1.svg new file mode 100644 index 0000000000..7496c6ae21 --- /dev/null +++ b/dom/smil/crashtests/699325-1.svg @@ -0,0 +1,5 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <rect fill="blue" height="100" width="100"> + <animate id="a" attributeName="x" calcMode="paced" values="50; 50; 50"/> + </rect> +</svg> diff --git a/dom/smil/crashtests/709907-1.svg b/dom/smil/crashtests/709907-1.svg new file mode 100644 index 0000000000..631911970c --- /dev/null +++ b/dom/smil/crashtests/709907-1.svg @@ -0,0 +1,3 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <animate attributeName="stroke-dasharray" from="-3" /> +</svg> diff --git a/dom/smil/crashtests/720103-1.svg b/dom/smil/crashtests/720103-1.svg new file mode 100644 index 0000000000..a51a3bf0fc --- /dev/null +++ b/dom/smil/crashtests/720103-1.svg @@ -0,0 +1,4 @@ +<?xml version="1.0"?> +<svg xmlns="http://www.w3.org/2000/svg"> +<animate id="a" begin="-3.1s" end="a.begin+0.2s"/> +</svg> diff --git a/dom/smil/crashtests/849593-1.xhtml b/dom/smil/crashtests/849593-1.xhtml new file mode 100644 index 0000000000..95b9b2feb8 --- /dev/null +++ b/dom/smil/crashtests/849593-1.xhtml @@ -0,0 +1,34 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head class="reftest-wait"> +<meta charset="utf-8"/> +<script> +<![CDATA[ + +function boom() +{ + var a = document.getElementById('a'); + var b = document.getElementById('b'); + var c = document.getElementById('c'); + var d = document.getElementById('d'); + + b.setCurrentTime(1); + + a.appendChild(c); + document.body.removeChild(a); + b.appendChild(c); + document.documentElement.offsetHeight; + d.appendChild(a); + + document.documentElement.removeAttribute('class'); +} + +]]> +</script> +</head> + +<body onload="setTimeout(boom, 0);"> +<svg xmlns="http://www.w3.org/2000/svg" id="a"/> +<svg xmlns="http://www.w3.org/2000/svg" id="b"/> +<set xmlns="http://www.w3.org/2000/svg" begin="1s" id="c"><div xmlns="http://www.w3.org/1999/xhtml" id="d"></div></set> +</body> +</html> diff --git a/dom/smil/crashtests/crashtests.list b/dom/smil/crashtests/crashtests.list new file mode 100644 index 0000000000..f74c364af0 --- /dev/null +++ b/dom/smil/crashtests/crashtests.list @@ -0,0 +1,61 @@ +load 483584-1.svg +load 483584-2.svg +load 523188-1.svg +load 525099-1.svg +load 526536-1.svg +load 526875-1.svg +load 526875-2.svg +load 529387-1.xhtml +load 531550-1.svg +load 541297-1.svg +load 547333-1.svg +load 548899-1.svg +load 551620-1.svg +load 554141-1.svg +load 554202-2.svg +load 555026-1.svg +load 556841-1.svg +load 572938-1.svg +load 572938-2.svg +load 572938-3.svg +load 572938-4.svg +load 588287-1.svg +load 588287-2.svg +load 590425-1.html +load 594653-1.svg +load 596796-1.svg +load 605345-1.svg +load 606101-1.svg +load 608295-1.html +load 608549-1.svg +load 611927-1.svg +load 615002-1.svg +load 615872-1.svg +load 641388-1.html +load 641388-2.html +load 650732-1.svg +load 665334-1.svg +load 669225-1.svg +load 669225-2.svg +load 670313-1.svg +load 678822-1.svg +load 678847-1.svg +load 678938-1.svg +load 690994-1.svg +load 691337-1.svg +load 691337-2.svg +load 697640-1.svg +load 699325-1.svg +load 709907-1.svg +load 720103-1.svg +load 849593-1.xhtml +load 1010681-1.svg +load 1322770-1.svg +load 1322849-1.svg +load 1343357-1.html +load 1375596-1.svg +load 1402547-1.html +load 1411963-1.html +load 1413319-1.html +load 1535388-1.html +load 1780800-1.html |
