diff options
Diffstat (limited to 'image/test/crashtests')
73 files changed, 1334 insertions, 0 deletions
diff --git a/image/test/crashtests/1205923-1.html b/image/test/crashtests/1205923-1.html new file mode 100644 index 0000000000..456fc51b6e --- /dev/null +++ b/image/test/crashtests/1205923-1.html @@ -0,0 +1,36 @@ +<!DOCTYPE html>
+<html class="reftest-wait">
+<body>
+</body>
+<script>
+ function createImage(loadHandler) {
+ var newImage = new Image;
+ newImage.id = "thepreviewimage";
+ newImage.setAttribute("src", "unsized-svg.svg");
+ if (loadHandler) {
+ newImage.onload = loadHandler;
+ }
+
+ // Query width & height, and display them in document:
+ physWidth = newImage.width;
+ physHeight = newImage.height;
+ document.documentElement.innerHTML +=
+ physWidth + " x " + physHeight + "<br>";
+ }
+
+ function part2() {
+ // Load image again:
+ createImage();
+
+ // End the crashtest.
+ document.documentElement.removeAttribute("class");
+ }
+
+ function startTest() {
+ // Trigger image load, and call part2() when it's loaded:
+ createImage(part2);
+ }
+
+ startTest();
+</script>
+</html>
diff --git a/image/test/crashtests/1210745-1.gif b/image/test/crashtests/1210745-1.gif Binary files differnew file mode 100644 index 0000000000..92bcf72224 --- /dev/null +++ b/image/test/crashtests/1210745-1.gif diff --git a/image/test/crashtests/1212954-1.svg b/image/test/crashtests/1212954-1.svg new file mode 100644 index 0000000000..83dd7b9c7f --- /dev/null +++ b/image/test/crashtests/1212954-1.svg @@ -0,0 +1,16 @@ +<svg xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink"> + + <defs> + <filter id="f"> + <!-- the image data is + <svg xmlns="http://www.w3.org/2000/svg" width="-5" height="1%" /> + --> + <feImage xlink:href="data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSItNSIgaGVpZ2h0 +PSIxJSIgLz4K" /> + </filter> + </defs> + + <rect width="1" height="1" filter="url(#f)" /> + +</svg> diff --git a/image/test/crashtests/1235605.gif b/image/test/crashtests/1235605.gif Binary files differnew file mode 100644 index 0000000000..e7c3ea0b87 --- /dev/null +++ b/image/test/crashtests/1235605.gif diff --git a/image/test/crashtests/1241728-1.html b/image/test/crashtests/1241728-1.html new file mode 100644 index 0000000000..126c02e624 --- /dev/null +++ b/image/test/crashtests/1241728-1.html @@ -0,0 +1,17 @@ +<html> +<body> +<img id='m1' src='data:image/bmp;base64,Qk16AAAAAAAAAJUAABMoAAAAIA4AACAAACYBAAQAAgAAAAB/AAQCAADE9Sj/AAkAAAAAAAAR4AAAAAD/AAAA//8A////AAAAAAAAAAAAAAAAADAAMzMzMzMzMDMzMwMzGAMzMzMzMzMwABEIAf8AAAAzMzMzMzMwADIzMxERERMzMxERERGAADMzMwAAAIAzMzMzMzMzPzMzMwAAADAAADNGMzMzM0JNegAAAAAAABN2AAAAKAAAACAOAAAgFgAAAQAEAAIAAAAAfxYAEgsAABILAAAAABp/VLge/AAA/+D6AAAAAP8AAP//AP///wAAAAAwAAMzMzMzIgOPMzMzOxCA/42NjY2NjY2NjY0zM0EcMzLgMzAzMzMzMzMzMzMzMzMfAAAREREz/xE2MzczMzwWMzMAAACAMzMzLzMzMz8zMzMAAAAwAAAzRkZGRkYzMzAzMwkDMzMwSjMzMxEzMzMwABERAR4EADPyMzMzMzMwFhYWLQAAAIAzERYGFhYWFhYWVhYWFhYWFhYWFhYWFhYWFhYWFhsWAxYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYzM0EcMzLgMzAzMzMWFhYWFhYW//8AAAMWFhYWFhYWFhEZEREDMzMzMzMzMzMwfzMzM1AzMAMzMzQgAAAAEQMzMzMwFwAIAIMzMzMeYRAcMzLgMzAzMzMzAzL4MzMzMzPoAzMzMzMv+i/uMzMzMzM='> +<img id='m2' height='2' width='2'> +<canvas id='c1'></canvas> +<script> + var im1=document.getElementById('m1'); + var im2=document.getElementById('m2'); + im2.src=im1.src; + window.onload=function(){ + var ctx=document.getElementById('c1').getContext('2d'); + ctx.drawImage(im1, 0, 0); + ctx.drawImage(im2, 0, 0); + } +</script> +</body> +</html>
\ No newline at end of file diff --git a/image/test/crashtests/1241729-1.bmp b/image/test/crashtests/1241729-1.bmp Binary files differnew file mode 100644 index 0000000000..e6f36d0398 --- /dev/null +++ b/image/test/crashtests/1241729-1.bmp diff --git a/image/test/crashtests/1241729-1.html b/image/test/crashtests/1241729-1.html new file mode 100644 index 0000000000..47f23134b4 --- /dev/null +++ b/image/test/crashtests/1241729-1.html @@ -0,0 +1,5 @@ +<html> +<body> +<img src="1241729-1.bmp" style="width: 10px; height: 10px;"> +</body> +</html> diff --git a/image/test/crashtests/1242093-1.html b/image/test/crashtests/1242093-1.html new file mode 100644 index 0000000000..3eab166efd --- /dev/null +++ b/image/test/crashtests/1242093-1.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset='UTF-8'> +<meta http-equiv='Cache-control' content='no-cache'> +</head> +<body> +<img id='m1' src='data:image/bmp;base64,Qk1mDgAAAAAAAHYAAAAoAAAAQAEAAPAAAAABAAQAAgAAAPANAADoAwAA6AMAABAAAAAAAAAA/wD/AAAAAAAAAP8AAP8AAP8AAAD///8AzMzMAMzMzADMzMwAzMzMAMzMzADMzMwAzMzMAMzMzADMzMwAzMzMAAACAAEAAgABAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAAAAAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRCAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBpRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAIAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICAGgiAAJqAGpEAAAAAgIAaCIAAmoAakQAAAACAgBoIgACagBqRAAAAAICADgRMCIAAmoAakQAAAACAgA4ETAiAAJqAGpEAAAAAgIABhEBVQURA1UDEQFVCREEVQIRBFUCEQFVCBEBVQYRMCIAAmoAakQAAAACAgAGEQFVBBEBVQMRAVUCEQFVCREBVQURAVUFEQFVCBEBVQYRMCIAAmoAakQAAAACAgAGEQFVBBEBVQMRAVUCEQFVCREBVQURAVUFEQFVCBEBVQYRMCIAAmoAakQAAAACAgAGEQFVBBEBVQMRAVUCEQRVBhEBVQURA1UDEQNVBhEBVQYRMCIAAmoAakQAAAACAgAGEQFVBBEBVQMRAVUCEQFVAxEBVQURAVUFEQFVBREBVQgRAVUGETAiAAJqAGpEAAAAAgIABhEBVQQRAVUDEQFVAhEBVQMRAVUFEQFVBREBVQURAVUIEQFVBhEwIgACagBqRAAAAAICAAMRB1UCEQNVAxEEVQYRAVUFEQRVAhEEVQIRB1UDETAiAAJqAGpEAAAAAgIAOBEwIgACagBqRAAAAAICADgRMCIAAmoAakQAAAACAAEAAgABAAE='> +<img id='m2' height='2' width='2'> +<canvas id='c1'></canvas> +<script> + var im1=document.getElementById('m1'); + var im2=document.getElementById('m2'); + im2.src=im1.src; + window.onload=function(){ + var ctx=document.getElementById('c1').getContext('2d'); + ctx.drawImage(im1, 0, 0); // sync docoder call + ctx.drawImage(im2, 0, 0); // sync downscaler call + } +</script> +</body> +</html>
\ No newline at end of file diff --git a/image/test/crashtests/1242778-1.png b/image/test/crashtests/1242778-1.png Binary files differnew file mode 100644 index 0000000000..4504d54e45 --- /dev/null +++ b/image/test/crashtests/1242778-1.png diff --git a/image/test/crashtests/1249576-1.png b/image/test/crashtests/1249576-1.png Binary files differnew file mode 100644 index 0000000000..637dafbc2b --- /dev/null +++ b/image/test/crashtests/1249576-1.png diff --git a/image/test/crashtests/1251091-1.html b/image/test/crashtests/1251091-1.html new file mode 100644 index 0000000000..520a393b43 --- /dev/null +++ b/image/test/crashtests/1251091-1.html @@ -0,0 +1,51 @@ +<!doctype html> +<html class="reftest-wait"> + <head> + <script type="text/javascript"> +var gl; + +function start() { + var canvas = document.getElementById("glcanvas"); + gl = canvas.getContext("webgl") || canvas.getContext("experimental-webgl"); + + if (gl) { + initTextures(); + } else { + finish(); + } +} + +function initTextures() { + var cubeTexture = gl.createTexture(); + var cubeImage = document.getElementById("i"); + cubeImage.onload = function() { handleTextureLoaded(cubeImage, cubeTexture); } + cubeImage.onerror = function() { finish(); } + cubeImage.src = "1251091-1.png"; +} + +function handleTextureLoaded(image, texture) { + gl.bindTexture(gl.TEXTURE_2D, texture); + gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA, gl.RGBA, gl.UNSIGNED_BYTE, image); + gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_MAG_FILTER, gl.LINEAR); + gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_MIN_FILTER, gl.LINEAR_MIPMAP_NEAREST); + gl.generateMipmap(gl.TEXTURE_2D); + gl.bindTexture(gl.TEXTURE_2D, null); + setTimeout(showit,0); +} + +function showit() { + document.getElementById("i").style.display = ""; + finish(); +} + +function finish() { + document.documentElement.removeAttribute("class"); +} + </script> + </head> + + <body onload="start()"> + <canvas id="glcanvas" width="640" height="480"></canvas> + <img id="i" style="display: none;"> + </body> +</html>
\ No newline at end of file diff --git a/image/test/crashtests/1251091-1.png b/image/test/crashtests/1251091-1.png Binary files differnew file mode 100644 index 0000000000..078b19a569 --- /dev/null +++ b/image/test/crashtests/1251091-1.png diff --git a/image/test/crashtests/1253362-1.html b/image/test/crashtests/1253362-1.html new file mode 100644 index 0000000000..fdee850aab --- /dev/null +++ b/image/test/crashtests/1253362-1.html @@ -0,0 +1,11 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +</head> +<body> + +<div style="content: url(data:image/svg+xml;charset=utf-8,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20style%3D%22background%3A%20url%28data%3Aimage%2Fsvg%2Bxml%2C%253Csvg%2520xmlns%253D%2522http%253A%252F%252Fwww.w3.org%252F2000%252Fsvg%2522%253E%253C%252Fsvg%253E%29%22%3E%3C%2Fsvg%3E%0D%0A)"></div> + +</body> +</html> diff --git a/image/test/crashtests/1262549-1.gif b/image/test/crashtests/1262549-1.gif Binary files differnew file mode 100644 index 0000000000..7cb2e769d2 --- /dev/null +++ b/image/test/crashtests/1262549-1.gif diff --git a/image/test/crashtests/1277397-1.jpg b/image/test/crashtests/1277397-1.jpg Binary files differnew file mode 100644 index 0000000000..54f21182b6 --- /dev/null +++ b/image/test/crashtests/1277397-1.jpg diff --git a/image/test/crashtests/1355898-1.html b/image/test/crashtests/1355898-1.html new file mode 100644 index 0000000000..2df55b34ac --- /dev/null +++ b/image/test/crashtests/1355898-1.html @@ -0,0 +1,45 @@ +<!doctype html> +<html> + <head> + <script> +// Test that texImage2D on an animated image doesn't assert. + +var gl; + +function start() { + canvas = document.getElementById("glcanvas"); + gl = null; + + try { + gl = canvas.getContext("webgl") || canvas.getContext("experimental-webgl"); + } + catch(e) { + } + + if (!gl) { + return; + } + + var texture = gl.createTexture(); + var image = new Image(); + image.onload = function() { handleTextureLoaded(image, texture); } + image.src = "1249576-1.png"; // an animated png +} + +function handleTextureLoaded(image, texture) { + gl.bindTexture(gl.TEXTURE_2D, texture); + gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA, gl.RGBA, gl.UNSIGNED_BYTE, image); + gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_MAG_FILTER, gl.LINEAR); + gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_MIN_FILTER, gl.LINEAR_MIPMAP_NEAREST); + gl.generateMipmap(gl.TEXTURE_2D); + gl.bindTexture(gl.TEXTURE_2D, null); +} + </script> + </head> + + <body onload="start()"> + <canvas id="glcanvas" width="640" height="480"> + Your browser doesn't appear to support the <code><canvas></code> element. + </canvas> + </body> +</html>
\ No newline at end of file diff --git a/image/test/crashtests/1375842-1.html b/image/test/crashtests/1375842-1.html new file mode 100644 index 0000000000..457966a1b9 --- /dev/null +++ b/image/test/crashtests/1375842-1.html @@ -0,0 +1,16 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<style> +textarea { + border: red; + transform: rotate(-0.01rad); +} +</style> +</head> +<body> +<textarea></textarea> +</body> +</html> + diff --git a/image/test/crashtests/1413762-1.gif b/image/test/crashtests/1413762-1.gif Binary files differnew file mode 100644 index 0000000000..5dd10b8f25 --- /dev/null +++ b/image/test/crashtests/1413762-1.gif diff --git a/image/test/crashtests/1443232-1.gif b/image/test/crashtests/1443232-1.gif Binary files differnew file mode 100644 index 0000000000..198519e7c0 --- /dev/null +++ b/image/test/crashtests/1443232-1.gif diff --git a/image/test/crashtests/1443232-1.html b/image/test/crashtests/1443232-1.html new file mode 100644 index 0000000000..a7302e9e16 --- /dev/null +++ b/image/test/crashtests/1443232-1.html @@ -0,0 +1,30 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<body> +<img id='m1'><br/> +<script> + var im1=document.getElementById('m1'); + var step_state=0; + function handle_step(){ + step_state+=1; + if(step_state == 1){ + im1.src='data:image/gif;base64,R0lGODlhAQABAIABAP///wAAACwAAAAAAQABAAACAkQBADs='; + } + else if(step_state==2){ + im1.src='1443232-1.gif'; + } + else if(step_state==3){ + if(im1.height==2) + im1.height=1; + im1.height=2; + im1.getBoundingClientRect(); + setTimeout(function(){document.documentElement.classList.remove("reftest-wait");}, 1000); + } + } + document.addEventListener('DOMContentLoaded', function(){ + im1.addEventListener('load', handle_step, false); + im1.src='data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw=='; + }); +</script> +</body> +</html> diff --git a/image/test/crashtests/1509998.gif b/image/test/crashtests/1509998.gif Binary files differnew file mode 100644 index 0000000000..05b141ba5f --- /dev/null +++ b/image/test/crashtests/1509998.gif diff --git a/image/test/crashtests/1526717-1.html b/image/test/crashtests/1526717-1.html new file mode 100644 index 0000000000..b120340416 --- /dev/null +++ b/image/test/crashtests/1526717-1.html @@ -0,0 +1 @@ +<img height="64" width="64" src="fuzz-1311.png?0.5592939664601271">
\ No newline at end of file diff --git a/image/test/crashtests/1526717-1.png b/image/test/crashtests/1526717-1.png Binary files differnew file mode 100644 index 0000000000..5ac5b32744 --- /dev/null +++ b/image/test/crashtests/1526717-1.png diff --git a/image/test/crashtests/1629490-1-iframe.html b/image/test/crashtests/1629490-1-iframe.html new file mode 100644 index 0000000000..2d20e28eed --- /dev/null +++ b/image/test/crashtests/1629490-1-iframe.html @@ -0,0 +1 @@ +<img id="image1" src="finite-apng.png"> diff --git a/image/test/crashtests/1629490-1.html b/image/test/crashtests/1629490-1.html new file mode 100644 index 0000000000..f35568ca4e --- /dev/null +++ b/image/test/crashtests/1629490-1.html @@ -0,0 +1,49 @@ +<!DOCTYPE HTML> +<html class="reftest-wait"> +<head> +</head> +<body> +<div id="container"> + <iframe id='if' src="1629490-1-iframe.html"></iframe> +</div> + +<script> +let iterationsLeft = 25; + +function runTest() { + // Make sure the image is decoded and advanced to it's final frame. + let img = document.getElementById("if").contentWindow.document.getElementById("image1"); + img.decode().then(function() { + setTimeout(forceDiscard, 2000); + }); +} + +function showIframe() { + document.getElementById("container").style.display = ""; + document.documentElement.getBoundingClientRect(); + requestAnimationFrame(forceDecode); +} + +function forceDecode() { + let img = document.getElementById("if").contentWindow.document.getElementById("image1"); + img.decode().then(function() { + setTimeout(forceDiscard, 0); + }); +} + +function forceDiscard() { + iterationsLeft--; + if (iterationsLeft < 0) { + document.documentElement.className = ""; + return; + } + document.getElementById("container").style.display = "none"; + document.documentElement.getBoundingClientRect(); + requestAnimationFrame(() => { requestAnimationFrame( () => { setTimeout(showIframe, 0); } ) }); +} + +//window.addEventListener("load", runTest); +window.addEventListener("MozReftestInvalidate", runTest); +</script> +</body> +</html> diff --git a/image/test/crashtests/1634839-1-iframe.html b/image/test/crashtests/1634839-1-iframe.html new file mode 100644 index 0000000000..07c1b6545e --- /dev/null +++ b/image/test/crashtests/1634839-1-iframe.html @@ -0,0 +1 @@ +<img id="image1" src="rainbow.gif"> diff --git a/image/test/crashtests/1634839-1.html b/image/test/crashtests/1634839-1.html new file mode 100644 index 0000000000..865f83645f --- /dev/null +++ b/image/test/crashtests/1634839-1.html @@ -0,0 +1,51 @@ +<!DOCTYPE HTML> +<html class="reftest-wait"> +<head> +</head> +<body> +<div id="container"> + <iframe id='if' src="1634839-1-iframe.html"></iframe> +</div> + +<script> +let iterationsLeft = 1; + +let img = null; + +function runTest() { + // Make sure the image is decoded and advanced to it's final frame. + img = document.getElementById("if").contentWindow.document.getElementById("image1"); + img.decode().then(function() { + setTimeout(forceDiscard, 200); + }); +} + +function showIframe() { + document.getElementById("container").style.display = ""; + document.documentElement.getBoundingClientRect(); + requestAnimationFrame(forceDecode); +} + +function forceDecode() { + img.decode().then(function() { + setTimeout(forceDiscard, 0); + }); +} + +function forceDiscard() { + iterationsLeft--; + if (iterationsLeft < 0) { + document.documentElement.className = ""; + return; + } + document.getElementById("container").style.display = "none"; + document.documentElement.getBoundingClientRect(); + img.remove(); + requestAnimationFrame(() => { requestAnimationFrame( () => { setTimeout(showIframe, 0); } ) }); +} + +//window.addEventListener("load", runTest); +window.addEventListener("MozReftestInvalidate", runTest); +</script> +</body> +</html> diff --git a/image/test/crashtests/1634839-2-iframe.html b/image/test/crashtests/1634839-2-iframe.html new file mode 100644 index 0000000000..6907844499 --- /dev/null +++ b/image/test/crashtests/1634839-2-iframe.html @@ -0,0 +1 @@ +<img id="image1" src="out2.gif"> diff --git a/image/test/crashtests/1634839-2.html b/image/test/crashtests/1634839-2.html new file mode 100644 index 0000000000..d3629421fb --- /dev/null +++ b/image/test/crashtests/1634839-2.html @@ -0,0 +1,51 @@ +<!DOCTYPE HTML> +<html class="reftest-wait"> +<head> +</head> +<body> +<div id="container"> + <iframe id='if' src="1634839-2-iframe.html"></iframe> +</div> + +<script> +let iterationsLeft = 1; + +let img = null; + +function runTest() { + // Make sure the image is decoded and advanced to it's final frame. + img = document.getElementById("if").contentWindow.document.getElementById("image1"); + img.decode().then(function() { + setTimeout(forceDiscard, 1000); + }); +} + +function showIframe() { + document.getElementById("container").style.display = ""; + document.documentElement.getBoundingClientRect(); + requestAnimationFrame(forceDecode); +} + +function forceDecode() { + img.decode().then(function() { + setTimeout(forceDiscard, 0); + }); +} + +function forceDiscard() { + iterationsLeft--; + if (iterationsLeft < 0) { + document.documentElement.className = ""; + return; + } + document.getElementById("container").style.display = "none"; + document.documentElement.getBoundingClientRect(); + img.remove(); + requestAnimationFrame(() => { requestAnimationFrame( () => { setTimeout(showIframe, 0); } ) }); +} + +//window.addEventListener("load", runTest); +window.addEventListener("MozReftestInvalidate", runTest); +</script> +</body> +</html> diff --git a/image/test/crashtests/1676172-1-iframe.html b/image/test/crashtests/1676172-1-iframe.html new file mode 100644 index 0000000000..c989c579bb --- /dev/null +++ b/image/test/crashtests/1676172-1-iframe.html @@ -0,0 +1,13 @@ +<html> +<head> + <script> + document.addEventListener('DOMContentLoaded', () => { + const image = document.createElementNS('http://www.w3.org/1999/xhtml', 'img') + var extra = document.location.search.substr(1); + image.setAttribute('src', '1676172-1.gif' + '?' + extra) + document.documentElement.appendChild(image) + setTimeout('location.reload()', 400) + }) + </script> +</head> +</html> diff --git a/image/test/crashtests/1676172-1.gif b/image/test/crashtests/1676172-1.gif Binary files differnew file mode 100644 index 0000000000..c5635218d5 --- /dev/null +++ b/image/test/crashtests/1676172-1.gif diff --git a/image/test/crashtests/1676172-1.html b/image/test/crashtests/1676172-1.html new file mode 100644 index 0000000000..08374a4772 --- /dev/null +++ b/image/test/crashtests/1676172-1.html @@ -0,0 +1,57 @@ +<html class="reftest-wait"> +<head> +<script> +function setup() { + setTimeout(finish, 1500); +} +function finish() { + window.stop(); + document.documentElement.className = ""; +} +</script> +<style> + iframe { + width: 100px; + height: 100px; + } +</style> +</head> +<body onload="setup();"> +<script> +let numiframes = 30; + +const Cc = SpecialPowers.Cc; +const Ci = SpecialPowers.Ci; +let isDebugBuild = + Cc["@mozilla.org/xpcom/debug;1"].getService(Ci.nsIDebug2).isDebugBuild; +let isMac = + navigator.appVersion.toLowerCase().includes("mac") || + navigator.platform.toLowerCase().includes("mac"); + +// On some platforms too many animating and reloading gifs means we don't ever +// get enough time to serve paints so that there is never a period of time +// where there are no paints pending, so the reftest harness can't end the +// test. So we limit the number on those platforms, since we only need one +// iframe to reproduce the bug this is okay, more iframes just give more +// chance of reproducing it on any given run. +if (navigator.appVersion.includes("Windows")) { + numiframes = 16; +} +if (navigator.platform.includes("Linux")) { + numiframes = 10; +} +if (navigator.appVersion.includes("Android")) { + numiframes = 2; +} +if (isMac && isDebugBuild) { + numiframes = 20; +} +for (let i = 0; i < numiframes; i++) { + let ifr = document.createElement("iframe"); + document.body.appendChild(ifr) + ifr.src = "1676172-1-iframe.html?" + i; +} +setTimeout(finish, 1500); +</script> +</body> +</html> diff --git a/image/test/crashtests/1763581-1-iframe.html b/image/test/crashtests/1763581-1-iframe.html new file mode 100644 index 0000000000..6064183b9e --- /dev/null +++ b/image/test/crashtests/1763581-1-iframe.html @@ -0,0 +1,15 @@ +<!DOCTYPE html> +<html> + <head> + <script> + window.onload = function() { + img = document.querySelector(".animated-image") + const staticImage = new Image(); + staticImage.src = img.src; + } + </script> + </head> + <body> + <img class="animated-image" src="1763581-1.sjs"> + </body> +</html> diff --git a/image/test/crashtests/1763581-1.gif b/image/test/crashtests/1763581-1.gif Binary files differnew file mode 100644 index 0000000000..237d6a1722 --- /dev/null +++ b/image/test/crashtests/1763581-1.gif diff --git a/image/test/crashtests/1763581-1.html b/image/test/crashtests/1763581-1.html new file mode 100644 index 0000000000..167f541a24 --- /dev/null +++ b/image/test/crashtests/1763581-1.html @@ -0,0 +1,28 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<head> +<script> +window.onload = function() { + setTimeout(step, 500); +} + +var reloads = 5; + +function step() { + if (--reloads) { + document.getElementById("ifr").contentWindow.location.reload(); + } else { + document.documentElement.className = ""; + } +} + +function settimouestep() { + setTimeout(step, 500); +} +</script> +</head> +<body> + <iframe id="ifr" src="1763581-1-iframe.html" height="500" width="400" onload="settimouestep()"></iframe> +</body> +</html> + diff --git a/image/test/crashtests/1763581-1.sjs b/image/test/crashtests/1763581-1.sjs new file mode 100644 index 0000000000..9fb70dd463 --- /dev/null +++ b/image/test/crashtests/1763581-1.sjs @@ -0,0 +1,71 @@ + +function getFileStream(filename) +{ + // Get the location of this sjs file, and then use that to figure out where + // to find where our other files are. + var self = Components.classes["@mozilla.org/file/local;1"] + .createInstance(Components.interfaces.nsIFile); + self.initWithPath(getState("__LOCATION__")); + var file = self.parent; + file.append(filename); + + var fileStream = Components.classes['@mozilla.org/network/file-input-stream;1'] + .createInstance(Components.interfaces.nsIFileInputStream); + fileStream.init(file, 1, 0, false); + + return fileStream; +} + +// stolen from file_blocked_script.sjs +function setGlobalState(data, key) { + x = { + data, + QueryInterface: ChromeUtils.generateQI([]), + }; + x.wrappedJSObject = x; + setObjectState(key, x); +} + +function getGlobalState(key) { + var data; + getObjectState(key, function(x) { + data = x && x.wrappedJSObject.data; + }); + return data; +} + +const DELAY_MS = 100; +let gTimer; + +function handleRequest(request, response) { + let count = getGlobalState("count"); + if (count == null) { + count = 0; + } + + if (count > 0) { + response.processAsync(); + + gTimer = Cc["@mozilla.org/timer;1"].createInstance(Ci.nsITimer); + gTimer.init( + () => { + response.setStatusLine(request.httpVersion, 304, "Not Modified"); + response.finish(); + }, + DELAY_MS, + Ci.nsITimer.TYPE_ONE_SHOT + ); + + return; + } + + response.setStatusLine(request.httpVersion, 200, "OK"); + response.setHeader("Content-Type", "image/gif", false); + + var inputStream = getFileStream("1763581-1.gif"); + response.bodyOutputStream.writeFrom(inputStream, inputStream.available()); + inputStream.close(); + + count++; + setGlobalState(count, "count"); +} diff --git a/image/test/crashtests/1765871-1.jpg b/image/test/crashtests/1765871-1.jpg Binary files differnew file mode 100644 index 0000000000..11460a62c3 --- /dev/null +++ b/image/test/crashtests/1765871-1.jpg diff --git a/image/test/crashtests/256-height.ico b/image/test/crashtests/256-height.ico Binary files differnew file mode 100644 index 0000000000..6a3c5c1944 --- /dev/null +++ b/image/test/crashtests/256-height.ico diff --git a/image/test/crashtests/256-width.ico b/image/test/crashtests/256-width.ico Binary files differnew file mode 100644 index 0000000000..a82983ce4f --- /dev/null +++ b/image/test/crashtests/256-width.ico diff --git a/image/test/crashtests/463696.bmp b/image/test/crashtests/463696.bmp Binary files differnew file mode 100644 index 0000000000..ec80d54126 --- /dev/null +++ b/image/test/crashtests/463696.bmp diff --git a/image/test/crashtests/523528-1.gif b/image/test/crashtests/523528-1.gif Binary files differnew file mode 100644 index 0000000000..abadca7ad2 --- /dev/null +++ b/image/test/crashtests/523528-1.gif diff --git a/image/test/crashtests/523528-2.gif b/image/test/crashtests/523528-2.gif Binary files differnew file mode 100644 index 0000000000..5be3bd46f6 --- /dev/null +++ b/image/test/crashtests/523528-2.gif diff --git a/image/test/crashtests/570451.png b/image/test/crashtests/570451.png Binary files differnew file mode 100644 index 0000000000..c49f2d11f1 --- /dev/null +++ b/image/test/crashtests/570451.png diff --git a/image/test/crashtests/694165-1.xhtml b/image/test/crashtests/694165-1.xhtml new file mode 100644 index 0000000000..1e340a0f2f --- /dev/null +++ b/image/test/crashtests/694165-1.xhtml @@ -0,0 +1,510 @@ +<!DOCTYPE html [ + <!ENTITY thousand-g-elements " + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> + <g/><g/><g/><g/><g/> +"> + +]> + +<html xmlns="http://www.w3.org/1999/xhtml"> +<img src='data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg"> + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + &thousand-g-elements; + </svg>'/> +</html> diff --git a/image/test/crashtests/732319-1.html b/image/test/crashtests/732319-1.html new file mode 100644 index 0000000000..b9d9c6de87 --- /dev/null +++ b/image/test/crashtests/732319-1.html @@ -0,0 +1,2 @@ +<!DOCTYPE html> +<img crossorigin src="data:a/a,"> diff --git a/image/test/crashtests/83804-1.gif b/image/test/crashtests/83804-1.gif Binary files differnew file mode 100644 index 0000000000..3967c703f6 --- /dev/null +++ b/image/test/crashtests/83804-1.gif diff --git a/image/test/crashtests/844403-1.html b/image/test/crashtests/844403-1.html new file mode 100644 index 0000000000..ef207c0f9f --- /dev/null +++ b/image/test/crashtests/844403-1.html @@ -0,0 +1,10 @@ +<color style='background-image: url("data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZlcnNpb249IjEuMSINCiAgICAgd2lkdGg9IjEwMCIgaGVpZ2h0PSIxMDAiPg0KICA8cmVjdCB3aWR0aD0iMTAwJSIgaGVpZ2h0PSIxMDAlIiBmaWxsPSJibHVlIi8%2BDQo8L3N2Zz4NCg%3D%3D");'></color> +<iframe contenteditable=true></iframe> +<script> + document.body.innerHTML = ''; + function onload() { + e = document.createElementNS("http://www.w3.org/1998/Math/MathML", "share"); + document.body.appendChild(e); + } + document.addEventListener("DOMContentLoaded", onload); +</script> diff --git a/image/test/crashtests/856616.gif b/image/test/crashtests/856616.gif Binary files differnew file mode 100644 index 0000000000..0fac811014 --- /dev/null +++ b/image/test/crashtests/856616.gif diff --git a/image/test/crashtests/89341-1.gif b/image/test/crashtests/89341-1.gif Binary files differnew file mode 100644 index 0000000000..14b3892d17 --- /dev/null +++ b/image/test/crashtests/89341-1.gif diff --git a/image/test/crashtests/944353.jpg b/image/test/crashtests/944353.jpg Binary files differnew file mode 100644 index 0000000000..fd81c58263 --- /dev/null +++ b/image/test/crashtests/944353.jpg diff --git a/image/test/crashtests/colormap-range.gif b/image/test/crashtests/colormap-range.gif Binary files differnew file mode 100644 index 0000000000..887add653f --- /dev/null +++ b/image/test/crashtests/colormap-range.gif diff --git a/image/test/crashtests/crashtests.list b/image/test/crashtests/crashtests.list new file mode 100644 index 0000000000..d9f27ff3a0 --- /dev/null +++ b/image/test/crashtests/crashtests.list @@ -0,0 +1,71 @@ +# Bug 668068 - Maximum (256) width and height icons that we currently interpret as 0-width and 0-height. +load 256-height.ico +load 256-width.ico + +load 83804-1.gif +load 89341-1.gif +load 463696.bmp +load 570451.png +# Bug 1390704 - Skip on debug because it triggers a quadratic behavior that makes it take +# so much time that it can trip on the reftest timeout of 5 minutes. +skip-if(Android||isDebugBuild||ThreadSanitizer) load 694165-1.xhtml +load 732319-1.html +load 844403-1.html +load 856616.gif +skip-if(ThreadSanitizer) load 944353.jpg +load 1205923-1.html +# Ensure we handle detecting that an image is animated, then failing to decode +# it. (See bug 1210745.) +load 1210745-1.gif +load 1212954-1.svg +load 1235605.gif +load 1241728-1.html +load 1241729-1.html +load 1242093-1.html +skip-if(/^Windows\x20NT\x2010\.0/.test(http.oscpu)&&/^aarch64-msvc/.test(xulRuntime.XPCOMABI)) load 1242778-1.png +load 1249576-1.png +load 1253362-1.html +skip-if(Android&&browserIsRemote) load 1355898-1.html # bug 1507207 +load 1375842-1.html +load 1413762-1.gif +pref(image.downscale-during-decode.enabled,true) load 1443232-1.html +load colormap-range.gif +HTTP load delayedframe.sjs # A 3-frame animated GIF with an inordinate delay between the second and third frame + +# Animated gifs with a very large canvas, but tiny actual content. +load delaytest.html?523528-1.gif +load delaytest.html?523528-2.gif + +load delaytest.html?1262549-1.gif +load delaytest.html?1277397-1.jpg + +# Bug 1160801 - Ensure that we handle invalid disposal types. +load invalid-disposal-method-1.gif +load invalid-disposal-method-2.gif +load invalid-disposal-method-3.gif + +load invalid-icc-profile.jpg # This would have exposed the leak discovered in bug 642902 + +# Ensure we handle ICO directory entries which specify the wrong size for the contained resource. +load invalid_ico_height.ico +load invalid_ico_width.ico + +# Bug 525326 - Test image sizes of 65535x65535 which is larger than we allow) +load invalid-size.gif +load invalid-size-second-frame.gif + +load multiple-png-hassize.ico # Bug 863958 - This icon's size is such that it leads to multiple writes to the PNG decoder after we've gotten our size. +skip-if(ThreadSanitizer) asserts(0-2) load ownerdiscard.html # Bug 1323672, bug 807211 +load truncated-second-frame.png # Bug 863975 + +# Bug 1509998 - Ensure that we handle empty frame rects in animated images. +load 1509998.gif + +load 1526717-1.html +skip-if(ThreadSanitizer) load 1629490-1.html + +HTTP load 1634839-1.html +HTTP load 1634839-2.html +pref(image.animated.decode-on-demand.batch-size,1) pref(image.animated.decode-on-demand.threshold-kb,0) HTTP load 1676172-1.html +pref(browser.soft_reload.only_force_validate_top_level_document,false) HTTP load 1763581-1.html +load 1765871-1.jpg diff --git a/image/test/crashtests/delayedframe.sjs b/image/test/crashtests/delayedframe.sjs new file mode 100644 index 0000000000..0cd7ce97e9 --- /dev/null +++ b/image/test/crashtests/delayedframe.sjs @@ -0,0 +1,44 @@ +function getFileStream(filename) +{ + // Get the location of this sjs file, and then use that to figure out where + // to find where our other files are. + var self = Components.classes["@mozilla.org/file/local;1"] + .createInstance(Components.interfaces.nsIFile); + self.initWithPath(getState("__LOCATION__")); + var file = self.parent; + file.append(filename); + dump(file.path + "\n"); + + var fileStream = Components.classes['@mozilla.org/network/file-input-stream;1'] + .createInstance(Components.interfaces.nsIFileInputStream); + fileStream.init(file, 1, 0, false); + + return fileStream; +} + +var gTimer; + +function handleRequest(request, response) +{ + response.processAsync(); + response.setStatusLine(request.httpVersion, 200, "OK"); + response.setHeader("Content-Type", "image/gif", false); + + var firststream = getFileStream("threeframes-start.gif"); + response.bodyOutputStream.writeFrom(firststream, firststream.available()) + firststream.close(); + + gTimer = Components.classes["@mozilla.org/timer;1"].createInstance(Components.interfaces.nsITimer); + gTimer.initWithCallback(function() + { + var secondstream = getFileStream("threeframes-end.gif"); + response.bodyOutputStream.writeFrom(secondstream, secondstream.available()) + secondstream.close(); + response.finish(); + + // This time needs to be longer than the animation timer in + // threeframes-start.gif. That's specified as 100ms; just use 5 seconds as + // a reasonable upper bound. Since this is just a crashtest, timeouts + // aren't a big deal. + }, 5 * 1000 /* milliseconds */, Components.interfaces.nsITimer.TYPE_ONE_SHOT); +} diff --git a/image/test/crashtests/delaytest.html b/image/test/crashtests/delaytest.html new file mode 100644 index 0000000000..fb368c1e90 --- /dev/null +++ b/image/test/crashtests/delaytest.html @@ -0,0 +1,59 @@ +<!DOCTYPE HTML> +<html class="reftest-wait"> +<head> +<title>Delayed image reftest wrapper</title> +</head> +<body> +<!-- non-empty alt to avoid the broken image icon --> +<img id="image1" alt=" "> +<script> + +window.addEventListener("MozReftestInvalidate", reftestInvalidateListener); + +// This loads a externally specified image, forces a draw (in case of +// decode-on-draw), waits 350ms, and then triggers the reftest snapshot. +// This allows the animation on the page to complete. +// +// Use as "delaytest.html?animation.png" +// + +// Get the image URL from our URL +var imgURL = document.location.search.substr(1); + +// Load the image +var img = document.images[0]; +img.src = imgURL; +img.onload = forceDecode; +img.onerror = forceDecode; + +let decodeComplete = false; +let gotReftestInvalidate = false; + +function forceDecode() { + img.decode().then(function() { + decodeComplete = true; + maybeStartTimer(); + }, function() { + decodeComplete = true; + maybeStartTimer(); + }); +} + +function reftestInvalidateListener() { + gotReftestInvalidate = true; + maybeStartTimer(); +} + +function maybeStartTimer() { + if (decodeComplete && gotReftestInvalidate) { + startTimer(); + } +} + +function startTimer() { + const delay = 350; + setTimeout("document.documentElement.className = '';", delay); +} +</script> +</body> +</html> diff --git a/image/test/crashtests/discardframe.htm b/image/test/crashtests/discardframe.htm new file mode 100644 index 0000000000..5ced0029c5 --- /dev/null +++ b/image/test/crashtests/discardframe.htm @@ -0,0 +1 @@ +<img src=ie.png> diff --git a/image/test/crashtests/finite-apng.png b/image/test/crashtests/finite-apng.png Binary files differnew file mode 100644 index 0000000000..778613d851 --- /dev/null +++ b/image/test/crashtests/finite-apng.png diff --git a/image/test/crashtests/ie.png b/image/test/crashtests/ie.png Binary files differnew file mode 100644 index 0000000000..74c4a1a323 --- /dev/null +++ b/image/test/crashtests/ie.png diff --git a/image/test/crashtests/invalid-disposal-method-1.gif b/image/test/crashtests/invalid-disposal-method-1.gif Binary files differnew file mode 100644 index 0000000000..30c61de188 --- /dev/null +++ b/image/test/crashtests/invalid-disposal-method-1.gif diff --git a/image/test/crashtests/invalid-disposal-method-2.gif b/image/test/crashtests/invalid-disposal-method-2.gif Binary files differnew file mode 100644 index 0000000000..66158d81a9 --- /dev/null +++ b/image/test/crashtests/invalid-disposal-method-2.gif diff --git a/image/test/crashtests/invalid-disposal-method-3.gif b/image/test/crashtests/invalid-disposal-method-3.gif Binary files differnew file mode 100644 index 0000000000..0da0723773 --- /dev/null +++ b/image/test/crashtests/invalid-disposal-method-3.gif diff --git a/image/test/crashtests/invalid-icc-profile.jpg b/image/test/crashtests/invalid-icc-profile.jpg Binary files differnew file mode 100644 index 0000000000..938c7713ce --- /dev/null +++ b/image/test/crashtests/invalid-icc-profile.jpg diff --git a/image/test/crashtests/invalid-size-second-frame.gif b/image/test/crashtests/invalid-size-second-frame.gif Binary files differnew file mode 100644 index 0000000000..22005ae4ca --- /dev/null +++ b/image/test/crashtests/invalid-size-second-frame.gif diff --git a/image/test/crashtests/invalid-size.gif b/image/test/crashtests/invalid-size.gif Binary files differnew file mode 100644 index 0000000000..665ca9b5dc --- /dev/null +++ b/image/test/crashtests/invalid-size.gif diff --git a/image/test/crashtests/invalid_ico_height.ico b/image/test/crashtests/invalid_ico_height.ico Binary files differnew file mode 100644 index 0000000000..50d6842278 --- /dev/null +++ b/image/test/crashtests/invalid_ico_height.ico diff --git a/image/test/crashtests/invalid_ico_width.ico b/image/test/crashtests/invalid_ico_width.ico Binary files differnew file mode 100644 index 0000000000..4ace07c16f --- /dev/null +++ b/image/test/crashtests/invalid_ico_width.ico diff --git a/image/test/crashtests/multiple-png-hassize.ico b/image/test/crashtests/multiple-png-hassize.ico Binary files differnew file mode 100644 index 0000000000..6944220018 --- /dev/null +++ b/image/test/crashtests/multiple-png-hassize.ico diff --git a/image/test/crashtests/out2.gif b/image/test/crashtests/out2.gif Binary files differnew file mode 100644 index 0000000000..f062c7f20c --- /dev/null +++ b/image/test/crashtests/out2.gif diff --git a/image/test/crashtests/ownerdiscard.html b/image/test/crashtests/ownerdiscard.html new file mode 100644 index 0000000000..2e5be86023 --- /dev/null +++ b/image/test/crashtests/ownerdiscard.html @@ -0,0 +1,48 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<body> + <div id=tCF0> + <img id=victim src=ie.png> + <iframe src=discardframe.htm></iframe> + </div> + <script> + const Ci = SpecialPowers.Ci; + const Cc = SpecialPowers.Cc; + + function ImageDecoderObserverStub() + { + this.sizeAvailable = function sizeAvailable(aRequest) {} + this.frameComplete = function frameComplete(aRequest) {} + this.decodeComplete = function decodeComplete(aRequest) {} + this.loadComplete = function loadComplete(aRequest) {} + this.frameUpdate = function frameUpdate(aRequest) {} + this.discard = function discard(aRequest) {} + this.isAnimated = function isAnimated(aRequest) {} + } + var img = document.getElementById('victim'); + var observer = new ImageDecoderObserverStub(); + observer.discard = function() { + cleanupAndFinish(); + } + observer = SpecialPowers.wrapCallbackObject(observer); + var gObserver = Cc["@mozilla.org/image/tools;1"].getService(Ci.imgITools) + .createScriptedObserver(observer); + var imgLoadingContent = SpecialPowers.wrap(img); + imgLoadingContent.addObserver(gObserver); + function initCF() { + setTimeout(function() { document.adoptNode(tCF0); }, 0); + } + document.addEventListener("DOMContentLoaded", initCF); + + function cleanupAndFinish() { + imgLoadingContent.removeObserver(gObserver); + setTimeout("document.documentElement.className = '';", 0); + } + function loadhandler() { + setTimeout("cleanupAndFinish();", 30000); + } + window.addEventListener("load", function() { + SpecialPowers.pushPrefEnv({"set":[["min_discard_timeout_ms", 1]]}, loadhandler)}); + </script> +</body> +</html> diff --git a/image/test/crashtests/rainbow.gif b/image/test/crashtests/rainbow.gif Binary files differnew file mode 100644 index 0000000000..72a7816928 --- /dev/null +++ b/image/test/crashtests/rainbow.gif diff --git a/image/test/crashtests/threeframes-end.gif b/image/test/crashtests/threeframes-end.gif Binary files differnew file mode 100644 index 0000000000..baf6a418c2 --- /dev/null +++ b/image/test/crashtests/threeframes-end.gif diff --git a/image/test/crashtests/threeframes-start.gif b/image/test/crashtests/threeframes-start.gif Binary files differnew file mode 100644 index 0000000000..bc641a3166 --- /dev/null +++ b/image/test/crashtests/threeframes-start.gif diff --git a/image/test/crashtests/truncated-second-frame.png b/image/test/crashtests/truncated-second-frame.png Binary files differnew file mode 100644 index 0000000000..0aef5e44de --- /dev/null +++ b/image/test/crashtests/truncated-second-frame.png diff --git a/image/test/crashtests/unsized-svg.svg b/image/test/crashtests/unsized-svg.svg new file mode 100644 index 0000000000..714efc7ef0 --- /dev/null +++ b/image/test/crashtests/unsized-svg.svg @@ -0,0 +1 @@ +<svg xmlns="http://www.w3.org/2000/svg"></svg> |
