diff options
Diffstat (limited to 'layout/svg/crashtests')
260 files changed, 4113 insertions, 0 deletions
diff --git a/layout/svg/crashtests/1016145.svg b/layout/svg/crashtests/1016145.svg new file mode 100644 index 0000000000..5c362a17e1 --- /dev/null +++ b/layout/svg/crashtests/1016145.svg @@ -0,0 +1,5 @@ +<!-- svg mime type but html root --> +<html xmlns="http://www.w3.org/1999/xhtml"> + <body style="display: table-column-group;" /> +</html> + diff --git a/layout/svg/crashtests/1028512.svg b/layout/svg/crashtests/1028512.svg new file mode 100644 index 0000000000..0c9458b478 --- /dev/null +++ b/layout/svg/crashtests/1028512.svg @@ -0,0 +1,15 @@ +<!-- {lower,upper}-{roman,alpha} in svg --> +<svg xmlns="http://www.w3.org/2000/svg"> +<script> +<![CDATA[ + +function boom() +{ + document.documentElement.style.transition = "2s"; + document.documentElement.style.listStyleType = "lower-roman"; +} + +window.addEventListener("load", boom, false); + +]]> +</script></svg> diff --git a/layout/svg/crashtests/1072758.html b/layout/svg/crashtests/1072758.html new file mode 100644 index 0000000000..1d4c85fb87 --- /dev/null +++ b/layout/svg/crashtests/1072758.html @@ -0,0 +1,35 @@ +<style> +#x9 { + display:none; +} +</style> + +<body onload="go()"> +<svg> +<path id="a"></path> + +<mask id="m"> + <text id="y"> + <tspan id="x1"></tspan> + <textPath id="x2"></textPath> + <a id="x3">Hello</a> + <tspan><tspan id="x4"></tspan></tspan> + <tspan id="x5"></tspan> + </text> +</mask> + +<rect width="600" height="400" mask="url(#m)"/> +</svg> +</body> + +<script> + +function go() { + x1.style.display = "none"; + x2.style.display = "none"; + x3.style.display = "none"; + x4.style.display = "none"; + x5.id = "x9"; +}; + +</script> diff --git a/layout/svg/crashtests/1140080-1.svg b/layout/svg/crashtests/1140080-1.svg new file mode 100644 index 0000000000..d424562468 --- /dev/null +++ b/layout/svg/crashtests/1140080-1.svg @@ -0,0 +1,11 @@ +<svg xmlns="http://www.w3.org/2000/svg"> +<script> + +window.addEventListener("load", function() { + var stop = document.getElementsByTagName("stop")[0]; + stop.setAttribute("offset", "0"); +}, false); + +</script> +<stop/> +</svg> diff --git a/layout/svg/crashtests/1149542-1.svg b/layout/svg/crashtests/1149542-1.svg new file mode 100644 index 0000000000..7353f12775 --- /dev/null +++ b/layout/svg/crashtests/1149542-1.svg @@ -0,0 +1,9 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <style> + text { white-space: pre } + text::first-letter { color: red; } + tspan { display: none } + </style> + <text textLength="64"> +<tspan>a</tspan>b</text> +</svg> diff --git a/layout/svg/crashtests/1156581-1.svg b/layout/svg/crashtests/1156581-1.svg new file mode 100644 index 0000000000..97e5fb1ca9 --- /dev/null +++ b/layout/svg/crashtests/1156581-1.svg @@ -0,0 +1,12 @@ +<svg xmlns="http://www.w3.org/2000/svg" style="filter: url(#a); clip: rect(0px, 4rem, 2px, 2px);"> + <script> + function boom() + { + document.getElementById("a").style.overflow = "hidden"; + document.documentElement.style.fontSize = "10px"; + } + window.addEventListener("load", boom, false); + </script> + + <set id="a"/> +</svg> diff --git a/layout/svg/crashtests/1182496-1.html b/layout/svg/crashtests/1182496-1.html new file mode 100644 index 0000000000..1d95905a2d --- /dev/null +++ b/layout/svg/crashtests/1182496-1.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html> +<head> + <script> + function tweak(){ + document.body.innerHTML="fuzz" + } + </script> +</head> +<body onload="tweak()"> + <svg xmlns="http://www.w3.org/2000/svg"> + <text> + <foreignObject requiredFeatures="foo"> + <svg style="position: absolute;"/> + </foreignObject> + </text> + </svg> +</body> +</html> + + diff --git a/layout/svg/crashtests/1209525-1.svg b/layout/svg/crashtests/1209525-1.svg new file mode 100644 index 0000000000..21134df33b --- /dev/null +++ b/layout/svg/crashtests/1209525-1.svg @@ -0,0 +1,7 @@ +<svg xmlns="http://www.w3.org/2000/svg" + width="0" height="0"> + + <rect width="10" height="10" stroke="black" + vector-effect="non-scaling-stroke" /> + +</svg> diff --git a/layout/svg/crashtests/1223281-1.svg b/layout/svg/crashtests/1223281-1.svg new file mode 100644 index 0000000000..b548a9a600 --- /dev/null +++ b/layout/svg/crashtests/1223281-1.svg @@ -0,0 +1,24 @@ +<svg xmlns="http://www.w3.org/2000/svg"> +<script> +<![CDATA[ + +function forceFrameConstruction() +{ + document.documentElement.getBoundingClientRect(); +} + +function boom() +{ + document.documentElement.style.overflow = "scroll"; + forceFrameConstruction() + document.documentElement.style.visibility = "visible"; +} + +window.addEventListener("load", boom, false); + +]]> +</script> + +<rect style="perspective: 10em;" /> +</svg> + diff --git a/layout/svg/crashtests/1234726-1.svg b/layout/svg/crashtests/1234726-1.svg new file mode 100644 index 0000000000..ec807e2aba --- /dev/null +++ b/layout/svg/crashtests/1234726-1.svg @@ -0,0 +1,13 @@ +<svg xmlns="http://www.w3.org/2000/svg"> +<script> + +window.addEventListener("load", function() { + document.documentElement.style.fontSize = "70%"; + document.documentElement.setAttribute("transform", "scale(2)"); + var filt = document.createElementNS("http://www.w3.org/2000/svg", "filter"); + filt.style.borderWidth = "2rem"; + document.documentElement.appendChild(filt); +}, false); + +</script> +</svg> diff --git a/layout/svg/crashtests/1322537-1.html b/layout/svg/crashtests/1322537-1.html new file mode 100644 index 0000000000..04207db4ad --- /dev/null +++ b/layout/svg/crashtests/1322537-1.html @@ -0,0 +1,2 @@ +<svg> +<animateMotion path='M8,0l69,97m45,-17592186044414A71,23 46,0,0 16382,98Q50,10 48,72T21,0Z'/>
\ No newline at end of file diff --git a/layout/svg/crashtests/1322537-2.html b/layout/svg/crashtests/1322537-2.html new file mode 100644 index 0000000000..d0495d79af --- /dev/null +++ b/layout/svg/crashtests/1322537-2.html @@ -0,0 +1,15 @@ +<!DOCTYPE html> +<head> + <script> + function go() { + var path = document.getElementById("myPath"); + var len = path.getTotalLength(); + console.log(len); + } + </script> +</head> +<body onload="go()"> + <svg> + <path id="myPath" d="M45,-17592186044414A71,23 46,0,0 16382,98"/> + </svg> +</body> diff --git a/layout/svg/crashtests/1322852.html b/layout/svg/crashtests/1322852.html new file mode 100644 index 0000000000..728ea5c7a9 --- /dev/null +++ b/layout/svg/crashtests/1322852.html @@ -0,0 +1,2 @@ +<svg> +<ellipse stroke='-moz-mac-menushadow'/>
\ No newline at end of file diff --git a/layout/svg/crashtests/1348564.svg b/layout/svg/crashtests/1348564.svg new file mode 100644 index 0000000000..0cb28948e6 --- /dev/null +++ b/layout/svg/crashtests/1348564.svg @@ -0,0 +1,7 @@ +<?xml version="1.0"?> +<svg xmlns="http://www.w3.org/2000/svg"> +<g style="outline-style:auto;"> +<radialGradient style="transform-box:fill-box;transform:rotatex(15deg);"></radialGradient> +<rect x="200"></rect> +</g> +</svg> diff --git a/layout/svg/crashtests/1402109.html b/layout/svg/crashtests/1402109.html new file mode 100644 index 0000000000..81ef78a058 --- /dev/null +++ b/layout/svg/crashtests/1402109.html @@ -0,0 +1,11 @@ +<script> +function jsfuzzer() { +try { svgvar00012.getStartPositionOfChar(0); } catch(e) { } +} +</script> +<body onload=jsfuzzer()> +<table> +<caption>,HM>v((Ndeoi=&</caption> +<caption> +<svg> +<text id="svgvar00012"> diff --git a/layout/svg/crashtests/1402124.html b/layout/svg/crashtests/1402124.html new file mode 100644 index 0000000000..793b46b9a1 --- /dev/null +++ b/layout/svg/crashtests/1402124.html @@ -0,0 +1,10 @@ +<script> +function jsfuzzer() { +try { a.getExtentOfChar(0); } catch(e) { } +} +</script> +<body onload=jsfuzzer()> +<svg> +<switch> +<path/> +<text id="a"> diff --git a/layout/svg/crashtests/1402486.html b/layout/svg/crashtests/1402486.html new file mode 100644 index 0000000000..af0c72e351 --- /dev/null +++ b/layout/svg/crashtests/1402486.html @@ -0,0 +1,12 @@ +<script> +function jsfuzzer() { +try { a.getEndPositionOfChar(0); } catch(e) { } +} +</script> +<body onload=jsfuzzer()> +<svg> +<switch> +<text id="a"> +</text> +<feTurbulence +<!-- a -->
\ No newline at end of file diff --git a/layout/svg/crashtests/1403656-1.html b/layout/svg/crashtests/1403656-1.html new file mode 100644 index 0000000000..996562d150 --- /dev/null +++ b/layout/svg/crashtests/1403656-1.html @@ -0,0 +1,19 @@ +<!DOCTYPE html> +<html class="filtered"> +<style> + .filtered { + filter: url(#notsvg); + } + #notsvg { + float: left; + overflow: auto; + } +</style> +<script> +function go() { + const div = document.createElement('div') + div.setAttribute('id', 'notsvg') + document.documentElement.appendChild(div) +} +</script> +<body onload="go();" class="filtered"> diff --git a/layout/svg/crashtests/1403656-2.html b/layout/svg/crashtests/1403656-2.html new file mode 100644 index 0000000000..e4287e933f --- /dev/null +++ b/layout/svg/crashtests/1403656-2.html @@ -0,0 +1,21 @@ +<!-- MUST BE QUIRKS MODE --> +<style> +span { top: 0%; } +</style> +<script> +function jsfuzzer() { + try { text.setAttribute("font-size", "10px"); } catch(e) { } +} +</script> +<body onload=jsfuzzer()> + <div style="overflow: scroll"> + <span></span> + </div> + <svg> + <tref id="marker"> + <text id="text"/> + </tref> + <polyline marker-end="url(#marker)"> + </polyline> + </svg> +</body> diff --git a/layout/svg/crashtests/1403656-3.html b/layout/svg/crashtests/1403656-3.html new file mode 100644 index 0000000000..a5a7632665 --- /dev/null +++ b/layout/svg/crashtests/1403656-3.html @@ -0,0 +1,8 @@ +<style> +* { columns: 0px } +</style> +A +<svg id="a"> +<line marker-end="url(#a)"> +</svg> +<keygen> diff --git a/layout/svg/crashtests/1403656-4.html b/layout/svg/crashtests/1403656-4.html new file mode 100644 index 0000000000..1da8979aa7 --- /dev/null +++ b/layout/svg/crashtests/1403656-4.html @@ -0,0 +1,9 @@ +<style>
+#a {}
+* {
+ text-align: end;
+ writing-mode: sideways-lr;
+ -webkit-filter: url(#a);
+}
+</style>
+<canvas>AAAAAAAAAAAAAAAA</canvas><ol id="a">@
diff --git a/layout/svg/crashtests/1403656-5.html b/layout/svg/crashtests/1403656-5.html new file mode 100644 index 0000000000..3d64bc5b50 --- /dev/null +++ b/layout/svg/crashtests/1403656-5.html @@ -0,0 +1,11 @@ +<style> +* { + -webkit-filter: url(#a); + padding-right: 1vmin; + overflow-y: scroll; +} +</style> +<details id="a"></details> +<image style="bottom: 1em;display:flex"></image> +<canvas height="1"> +<font> diff --git a/layout/svg/crashtests/1404086.html b/layout/svg/crashtests/1404086.html new file mode 100644 index 0000000000..df2ad6a3b3 --- /dev/null +++ b/layout/svg/crashtests/1404086.html @@ -0,0 +1,2 @@ +<svg> +<text textLength="0" lengthAdjust="spacingAndGlyphs">t diff --git a/layout/svg/crashtests/1421807-1.html b/layout/svg/crashtests/1421807-1.html new file mode 100644 index 0000000000..fe5a3e8d66 --- /dev/null +++ b/layout/svg/crashtests/1421807-1.html @@ -0,0 +1,5 @@ +<body onload=b.appendChild(a)> +<div id="a" style="display: contents"> +</div> +<svg> +<text id="b"> diff --git a/layout/svg/crashtests/1421807-2.html b/layout/svg/crashtests/1421807-2.html new file mode 100644 index 0000000000..30b100642c --- /dev/null +++ b/layout/svg/crashtests/1421807-2.html @@ -0,0 +1,15 @@ +<style> +.c1 { display: contents; } +</style> +<script> +function go() { + a.attachShadow({mode: "open"}).innerHTML = `<slot> </slot> `; + b.appendChild(a); +} +</script> +<body onload=go()> +<div id="a" class="c1"> + <span></span> +</div> +<svg> +<text id="b"> diff --git a/layout/svg/crashtests/1422226.html b/layout/svg/crashtests/1422226.html new file mode 100644 index 0000000000..5826e60b69 --- /dev/null +++ b/layout/svg/crashtests/1422226.html @@ -0,0 +1,39 @@ +<style id="htmlvar00001"> +* { + filter: saturate(1) hue-rotate(0deg); + marker-mid: url() +} +</style> +<script> +function jsfuzzer() { +try { var var00078 = window.find("foo",true,true); } catch(e) { } +try { htmlvar00004.setAttribute("onselect", "eventhandler2()"); } catch(e) { } +try { htmlvar00004.selectionStart = 1; } catch(e) { } +try { svgvar00030.addEventListener("DOMSubtreeModified", eventhandler5); } catch(e) { } +} +function eventhandler1() { +try { var var00098 = document.createElement("select"); } catch(e) { } +try { htmlvar00001.appendChild(var00098); } catch(e) { } +} +function eventhandler2() { +try { htmlvar00015.href = "3" } catch(e) { } +try { svgvar00008.before(svgvar00013); } catch(e) { } +try { var var00014 = window.getSelection(); } catch(e) { } +try { var00014.setBaseAndExtent(htmlvar00011,0,htmlvar00010,0); } catch(e) { } +try { var00014.collapseToStart(); } catch(e) { } +} +function eventhandler5() { +try { svgvar00001.addEventListener("DOMNodeRemoved", eventhandler1); } catch(e) { } +} +</script> +<body onload=jsfuzzer()> +<input id="htmlvar00004"> +<svg id="svgvar00001"> +<marker> +<meshgradient id="svgvar00008"> +<foreignObject id="svgvar00013"> +<discard id="svgvar00030"/> +<a id="htmlvar00010" contenteditable="true"></a> +<a id="htmlvar00011"> +<base id="htmlvar00015"> + diff --git a/layout/svg/crashtests/1425434-1.html b/layout/svg/crashtests/1425434-1.html new file mode 100644 index 0000000000..cec773ca25 --- /dev/null +++ b/layout/svg/crashtests/1425434-1.html @@ -0,0 +1,59 @@ +<html>
+<head>
+<style>
+
+#htmlvar00002,.class4,strong:last-of-type {
+ border-image-repeat: round stretch;
+ counter-increment:c
+}
+.class6,#htmlvar00001,#htmlvar00008 {
+ height:63%;
+ grid-column:span 0 middle / middle
+}
+#htmlvar00002 {
+ overflow-y:hidden;
+ grid-column-end:0 inherit
+}
+
+</style>
+<script>
+
+function eventhandler5() {
+
+ var var00066 = document.createElement("audio");
+ try { var00066.controls = true; } catch(e) { }
+
+ try { document.all['htmlvar00002'].appendChild(htmlvar00001); } catch(e) { }
+ try { document.all['htmlvar00002'].appendChild(var00066); } catch(e) { }
+}
+
+</script>
+</head>
+<body onload=eventhandler5()>
+
+ <shadow id="htmlvar00001" axis="PDcIvMde3=%- S^@dz" ondblclick="eventhandler1()" item="8z6h" checked="checked" type="text/x-javascript">
+ aaa
+ </shadow>
+
+ <ul id="htmlvar00002" type="video/mp4; codecs='avc1.4D400C'" type="turbulence" type="javascript_1.0"
+ role="complementary" dir="ltr" required="required" formnovalidate="formnovalidate" scheme="NIST" expanded="true" slot="slot2">
+ bbb
+ </ul>
+
+ <svg id="svgvar00001" marker-end="url(#svgvar00005)" transform="translate(0, 0) scale(0.113899652038) rotate(1) translate(0, 1)"
+ marker-mid="url(#svgvar00009)" xml:id="test-title" viewBox="0 1 78 1" click="none" glyph-orientation-vertical="-1" dominant-baseline="middle" ry="61%" k="1">
+
+ <path id="svgvar00009" d="M 0 0 L 1 0" stroke-dashoffset="inherit" onclick="eventhandler5()" stroke-linejoin="inherit"
+ fill-rule="evenodd" onmouseover="eventhandler3()" onfocusin="eventhandler4()" pointsAtY="1" target="_self" primitiveUnits="userSpaceOnUse" horiz-adv-x="0" />
+
+ <line id="svgvar00010" x1="0px" y1="55%" x2="76%" y2="62%" transform="translate(0 100) scale(0 -1)"
+ transform="translate(00.32347924876,0)" visibility="hidden" stroke-width="inherit" pointer-events="painted"
+ xlink:type="simple" onrepeat="eventhandler4()" clip-path="url(#svgvar00001)" vector-effect="non-scaling-stroke" azimuth="-1">
+ ccc
+ </line>
+
+ </svg>
+
+<!--endhtml-->
+</body>
+</html>
diff --git a/layout/svg/crashtests/1443092-helper.svg b/layout/svg/crashtests/1443092-helper.svg new file mode 100644 index 0000000000..134cbefb58 --- /dev/null +++ b/layout/svg/crashtests/1443092-helper.svg @@ -0,0 +1,6 @@ +<svg class='class2' xmlns='http://www.w3.org/2000/svg'> +<clipPath clipPathUnits='userSpaceOnUse' id='id9' lighting-color='pink' class='class0 class1' > +</clipPath> +<a id='id0' clip-path='url(#id9)' > +</a> +</svg> diff --git a/layout/svg/crashtests/1443092.html b/layout/svg/crashtests/1443092.html new file mode 100644 index 0000000000..7be4561e61 --- /dev/null +++ b/layout/svg/crashtests/1443092.html @@ -0,0 +1,34 @@ +<script> +function start() { + o7=document.createElement('div'); + o7.innerHTML='<style>@keyframes key7{ from{ transform: rotate(-536870911deg)}}\n*{ animation-name: key7; animation-duration: 0.001s'; + o17=document.createElement('div'); + o17.innerHTML='<svg><style>@font-face{}\n*{ outline-style: dotted</style><style>@font-face{ font-family: font3; src: url('; + o18=o17.firstChild.getElementsByTagName('*'); + o20=o18[0]; + o23=o18[1]; + o114=document.createElement('iframe'); + o114.src='1443092-helper.svg'; + o114.addEventListener('load', fun0,false); + document.body.appendChild(o114); +} +function fun0() { + o117=o114.contentDocument; + document.replaceChild(o117.documentElement,document.documentElement); + o124=document.createElement('iframe'); + document.documentElement.appendChild(o124); + o145=document.createElement('div'); + o145.innerHTML='<svg><set attributeName="text-decoration">'; + document.documentElement.appendChild(o20); + document.documentElement.appendChild(o23); + document.documentElement.appendChild(o7); + o124.src='x'; + document.documentElement.appendChild(o145); + o264=document.createElement('style'); + o265=document.createTextNode('*{ float: left'); + o264.appendChild(o265); + o23.appendChild(o264); + setTimeout("location.reload()",40); +} +</script> +<body onload="start()"></body> diff --git a/layout/svg/crashtests/1454201-1.html b/layout/svg/crashtests/1454201-1.html new file mode 100644 index 0000000000..b92a7aa595 --- /dev/null +++ b/layout/svg/crashtests/1454201-1.html @@ -0,0 +1,52 @@ +<html> +<head> +<script> +function loader() { +var tbody = document.createElement("tbody"); +try { document.all[90%document.all.length].appendChild(tbody); } catch(e) { } +} +</script> +</head> +<body onload=loader()> +<span> +<a></a> +</span> +<a></a> +<svg marker-end="url(#poly)"> +<a></a> +<a></a> +<symbol > +<a></a> +</symbol> +<polyline id="poly"> +<a></a> +<a></a> +<a></a> +<a></a> +</polyline> +<line > +<a></a> +</line> +<a></a> +<span> +<a></a> +</span> +<a></a> +<a></a> +<a></a> +</svg> +<dialog style="-moz-appearance: checkbox; overflow-x: auto; max-width: 0em;" open="true"></dialog> +<a></a> +<a></a> +<span> +<a></a> +<a></a> +<a></a> +<a></a> +</span> +<a></a> +<a></a> +<a></a> +<a></a> +</body> +</html> diff --git a/layout/svg/crashtests/1467552-1.html b/layout/svg/crashtests/1467552-1.html new file mode 100644 index 0000000000..df85665c72 --- /dev/null +++ b/layout/svg/crashtests/1467552-1.html @@ -0,0 +1,15 @@ +<!DOCTYPE html> +<meta charset="UTF-8"> +<html> +<style> +fieldset { + mask: url(data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciLz4=), + padding-box; + margin-right: 75px; +} +span { + vertical-align: 672in; +} +</style> +<fieldset><span><video></video></span></fieldset> +</html> diff --git a/layout/svg/crashtests/1474982.html b/layout/svg/crashtests/1474982.html new file mode 100644 index 0000000000..c33e2be474 --- /dev/null +++ b/layout/svg/crashtests/1474982.html @@ -0,0 +1,2 @@ +<svg> +<text lengthAdjust="" textLength="0">A</text> diff --git a/layout/svg/crashtests/1480224.html b/layout/svg/crashtests/1480224.html new file mode 100644 index 0000000000..0bb0dfa7b5 --- /dev/null +++ b/layout/svg/crashtests/1480224.html @@ -0,0 +1,6 @@ +<svg> +<symbol id="a"> +<foreignObject> +<input type="file"> +</symbol> +<use xlink:href="#a"> diff --git a/layout/svg/crashtests/1480275.html b/layout/svg/crashtests/1480275.html new file mode 100644 index 0000000000..b21ebdd062 --- /dev/null +++ b/layout/svg/crashtests/1480275.html @@ -0,0 +1,15 @@ +<script> +function go() { + b.appendChild(a); + d.outerHTML = f.outerHTML; +} +</script> +<table> +<tr id="a"> +<th> +<svg id="c" onload="go()"> +<use xlink:href="#c"/> +</tr> +<code id="d"></code> +<video id="f"> +<details id="b"> diff --git a/layout/svg/crashtests/1502936.html b/layout/svg/crashtests/1502936.html new file mode 100644 index 0000000000..87892ab461 --- /dev/null +++ b/layout/svg/crashtests/1502936.html @@ -0,0 +1,11 @@ +<script> +function go() { + a.setAttribute("requiredExtensions", "x"); + b.getBoundingClientRect(); + a.setAttribute("y", "-1px"); +} +</script> +<body onload=go()> +<svg> +<use id="a"> +<feGaussianBlur id="b"> diff --git a/layout/svg/crashtests/1504072.html b/layout/svg/crashtests/1504072.html new file mode 100644 index 0000000000..a44e2f0251 --- /dev/null +++ b/layout/svg/crashtests/1504072.html @@ -0,0 +1,4 @@ +<style> +svg { perspective: 0px } +</style> +<svg overflow="scroll" systemLanguage=""> diff --git a/layout/svg/crashtests/1504918.svg b/layout/svg/crashtests/1504918.svg new file mode 100644 index 0000000000..63cd3a08e0 --- /dev/null +++ b/layout/svg/crashtests/1504918.svg @@ -0,0 +1,4 @@ +<svg xmlns="http://www.w3.org/2000/svg">
+ <style>textPath { display: contents; }</style>
+ <text>x<textPath><textPath><tspan>y</tspan></textPath></textPath></text>
+</svg>
\ No newline at end of file diff --git a/layout/svg/crashtests/1535517-1.svg b/layout/svg/crashtests/1535517-1.svg new file mode 100644 index 0000000000..6f3f17eabf --- /dev/null +++ b/layout/svg/crashtests/1535517-1.svg @@ -0,0 +1,11 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<marker><text><tspan id="x"/></text></marker> + +<script> +window.addEventListener("load", function() { + document.getElementById("x").appendChild(document.createTextNode("\u062Ax")); +}, false); +</script> + +</svg> diff --git a/layout/svg/crashtests/1536892.html b/layout/svg/crashtests/1536892.html new file mode 100644 index 0000000000..8bc237138e --- /dev/null +++ b/layout/svg/crashtests/1536892.html @@ -0,0 +1,13 @@ +<style>
+* { -webkit-filter: blur(5px) }
+</style>
+<script>
+function go() {
+ a.setAttribute("text-decoration", "overline")
+}
+</script>
+<body onload=go()>
+<svg id="a">
+<marker>
+<foreignObject>
+<li style="-webkit-box-shadow:8px 0 1px">
diff --git a/layout/svg/crashtests/1539318-1.svg b/layout/svg/crashtests/1539318-1.svg new file mode 100644 index 0000000000..d832f448a3 --- /dev/null +++ b/layout/svg/crashtests/1539318-1.svg @@ -0,0 +1,10 @@ +<script> +window.onload = function() { + a.getComputedTextLength() +} +</script> +<body> +<svg> +<switch> +<hatch> +<text id="a">A</text> diff --git a/layout/svg/crashtests/1548985-1.html b/layout/svg/crashtests/1548985-1.html new file mode 100644 index 0000000000..7156eaf36b --- /dev/null +++ b/layout/svg/crashtests/1548985-1.html @@ -0,0 +1,16 @@ +<!-- a -->
+<style>
+:root { contain: size }
+</style>
+<script>
+window.requestIdleCallback(window.close)
+function go() {
+ a.appendChild(document.head)
+ let b = d.getRootNode({composed: true})
+ b.replaceChild(c, b.childNodes[1])
+}
+</script>
+<body onload=go()>
+<svg id="c">
+<feTile id="d" />
+<foreignObject id="a">
diff --git a/layout/svg/crashtests/1548985-2.svg b/layout/svg/crashtests/1548985-2.svg new file mode 100644 index 0000000000..700facb411 --- /dev/null +++ b/layout/svg/crashtests/1548985-2.svg @@ -0,0 +1,4 @@ +<svg xmlns="http://www.w3.org/2000/svg" + style="contain:size"> + <rect width="100px" height="100px" fill="lime"/> +</svg> diff --git a/layout/svg/crashtests/1555851.html b/layout/svg/crashtests/1555851.html new file mode 100644 index 0000000000..2b6f5a596a --- /dev/null +++ b/layout/svg/crashtests/1555851.html @@ -0,0 +1,8 @@ +<body>
+<script>
+ var o0 = document.createElementNS("http://www.w3.org/2000/svg", "svg")
+ document.body.appendChild(o0)
+ var o3 = document.createElementNS("http://www.w3.org/2000/svg", "animateMotion")
+ o0.appendChild(o3)
+ o3.setAttribute("path", "M9,2l2e37,3A40,2 85,102-1")
+</script>
diff --git a/layout/svg/crashtests/1563779.html b/layout/svg/crashtests/1563779.html new file mode 100644 index 0000000000..4c51d0884d --- /dev/null +++ b/layout/svg/crashtests/1563779.html @@ -0,0 +1,19 @@ +<script id="a"> +let count = 0; +function go() { + if (count++ == 3) + return; + try { a.appendChild(c) } catch(e) { } + try { window.getSelection().getRangeAt(0).insertNode(b) } catch(e) { } + try { d.selectSubString(0,-1) } catch(e) { } + document.documentElement.style.display = "none" + document.documentElement.getBoundingClientRect() + document.documentElement.style.display = "" +} +</script> +<pre id="b" style="display:contents">a</pre> +<span id="c"> +<style onload="go()"></style> +</span> +<svg> +<text id="d"><textPath xml:space="preserve"> diff --git a/layout/svg/crashtests/1600855.html b/layout/svg/crashtests/1600855.html new file mode 100644 index 0000000000..31c4809ecb --- /dev/null +++ b/layout/svg/crashtests/1600855.html @@ -0,0 +1,8 @@ +<script> +window.onload = () => { + a.append(String.fromCodePoint(71341)) +} +</script> +<font style="word-spacing: 31pc"> +<svg> +<text id="a">Text</text> diff --git a/layout/svg/crashtests/1601824.html b/layout/svg/crashtests/1601824.html new file mode 100644 index 0000000000..04d0de825d --- /dev/null +++ b/layout/svg/crashtests/1601824.html @@ -0,0 +1,7 @@ +<svg> +<polygon id="a" points="0 1"> +</polygon> +<text> +<textPath xlink:href="#a"> +<marker /> +<a systemLanguage=""> diff --git a/layout/svg/crashtests/1605223-1.html b/layout/svg/crashtests/1605223-1.html new file mode 100644 index 0000000000..6b476a7fd0 --- /dev/null +++ b/layout/svg/crashtests/1605223-1.html @@ -0,0 +1,4 @@ +<svg filter="url(#a)"> +<filter id="a"> +<feComponentTransfer> +<feFuncG type="" /> diff --git a/layout/svg/crashtests/1609663.html b/layout/svg/crashtests/1609663.html new file mode 100644 index 0000000000..c5a5d938e0 --- /dev/null +++ b/layout/svg/crashtests/1609663.html @@ -0,0 +1,34 @@ +<html>
+<head>
+</head>
+<body>
+<div id="main">
+ <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="mySvg" width="400" height="800">
+ <defs>
+ <pattern id="pattern1" x="30" y="10" width="30" height="30" patternUnits="userSpaceOnUse" >
+ <text id="idText1" x="15" y="15" font-size="20">1</text>
+ </pattern>
+ </defs>
+ <rect id="idRect1" fill="url(#pattern1)" width="300" height="200"/>
+ </svg>
+</div>
+<script>
+document.body.offsetHeight;
+
+var pattern = document.getElementById('pattern1');
+var text = document.getElementById('idText1');
+pattern.removeChild(text);
+
+var svgNS = "http://www.w3.org/2000/svg";
+var newText = document.createElementNS(svgNS,"text");
+newText.setAttributeNS(null,"id",'idText1');
+newText.setAttributeNS(null,"x",15);
+newText.setAttributeNS(null,"y",15);
+newText.setAttributeNS(null,"font-size","20");
+
+var textNode = document.createTextNode('x');
+newText.appendChild(textNode);
+pattern.appendChild(newText);
+</script>
+</body>
+</html>
diff --git a/layout/svg/crashtests/1671950.html b/layout/svg/crashtests/1671950.html new file mode 100644 index 0000000000..173ace4ea9 --- /dev/null +++ b/layout/svg/crashtests/1671950.html @@ -0,0 +1,27 @@ +<html> +<head> + <style> + * { + break-before: always ! important; + } + </style> + <script> + window.addEventListener('load', () => { + const style = document.createElement('style') + document.head.appendChild(style) + const svg_1 = document.getElementById('id_3') + const svg_2 = document.createElementNS('http://www.w3.org/2000/svg', 'svg') + const switch_0 = document.createElementNS('http://www.w3.org/2000/svg', 'switch') + const c_0 = document.createElementNS('http://www.w3.org/2000/svg', 'c') + switch_0.appendChild(c_0) + svg_1.appendChild(switch_0) + svg_2.appendChild(svg_1) + document.documentElement.appendChild(svg_2) + style.sheet.insertRule('@-moz-document url-prefix(){*,a{all:inherit', 0) + SpecialPowers.wrap(window).printPreview()?.close() + }) + </script> + <svg id='id_3'></svg> +</head> +</html> + diff --git a/layout/svg/crashtests/1678947.html b/layout/svg/crashtests/1678947.html new file mode 100644 index 0000000000..96a3a37862 --- /dev/null +++ b/layout/svg/crashtests/1678947.html @@ -0,0 +1,21 @@ +<html> +<head> +<style> +ol { float: right; } +</style> +<script> +function start() { + document.elementFromPoint(0,1); + document.dir = "rtl"; +} +</script> +</head> +<body> +<svg onload="start()" requiredExtensions="x"> + <g id="a"/></g> +<text> +<textPath xlink:href="#a"> +</svg> +<ol></ol> +</body> +</html> diff --git a/layout/svg/crashtests/1693032.html b/layout/svg/crashtests/1693032.html new file mode 100644 index 0000000000..49a2bf3c17 --- /dev/null +++ b/layout/svg/crashtests/1693032.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html> +<head> + <script> + document.addEventListener('DOMContentLoaded', () => { + const svg_1 = document.createElementNS('http://www.w3.org/2000/svg', 'svg') + const svg_2 = document.createElementNS('http://www.w3.org/2000/svg', 'svg') + const switch_1 = document.createElementNS('http://www.w3.org/2000/svg', 'switch') + const metadata_1 = document.createElementNS('http://www.w3.org/2000/svg', 'metadata') + const foreign_1 = document.createElementNS('http://www.w3.org/2000/svg', 'foreignObject') + const text_1 = document.createElementNS('http://www.w3.org/2000/svg', 'text') + switch_1.appendChild(metadata_1) + svg_2.appendChild(text_1) + foreign_1.appendChild(svg_2) + switch_1.appendChild(foreign_1) + svg_1.appendChild(switch_1) + document.documentElement.appendChild(svg_1) + }) + </script> +</head> +</html> diff --git a/layout/svg/crashtests/1696505.html b/layout/svg/crashtests/1696505.html new file mode 100644 index 0000000000..92700496e8 --- /dev/null +++ b/layout/svg/crashtests/1696505.html @@ -0,0 +1,9 @@ +<script> +document.addEventListener("DOMContentLoaded", () => { + document.getElementById('a').style.cssText += "grid-row-end:auto" +}) +</script> +<svg> +<polyline marker-mid='url(#a)'/> +<marker id='a'> +<text/> diff --git a/layout/svg/crashtests/1755770-1.html b/layout/svg/crashtests/1755770-1.html new file mode 100644 index 0000000000..ee9cf6fee7 --- /dev/null +++ b/layout/svg/crashtests/1755770-1.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html> +<head> + <script> + window.addEventListener("load", () => { + const svg = document.createElementNS("http://www.w3.org/2000/svg", "svg"); + const text = document.createElementNS("http://www.w3.org/2000/svg", "text"); + text.setAttribute("letter-spacing", "65535pc"); + const node = document.createTextNode("\rï¿»ð¨\nó = ð£%?;ð©á©¿ð�"); + text.appendChild(node); + svg.appendChild(text); + document.documentElement.appendChild(svg); + const rect = new DOMRectReadOnly(-128, 256, 0, 1024); + node.convertRectFromNode(rect, document, {}); + }) + </script> +</head> +</html> diff --git a/layout/svg/crashtests/1755770-2.html b/layout/svg/crashtests/1755770-2.html new file mode 100644 index 0000000000..31b42ec452 --- /dev/null +++ b/layout/svg/crashtests/1755770-2.html @@ -0,0 +1,19 @@ +<!DOCTYPE html> +<html> +<head> + <script> + window.addEventListener("load", () => { + const svg = document.createElementNS("http://www.w3.org/2000/svg", "svg"); + const text = document.createElementNS("http://www.w3.org/2000/svg", "text"); + text.setAttribute("letter-spacing", "65535pc"); + text.setAttribute("writing-mode", "vertical-lr"); + const node = document.createTextNode("\rï¿»ð¨\nó = ð£%?;ð©á©¿ð�"); + text.appendChild(node); + svg.appendChild(text); + document.documentElement.appendChild(svg); + const rect = new DOMRectReadOnly(-128, 256, 0, 1024); + node.convertRectFromNode(rect, document, {}); + }) + </script> +</head> +</html> diff --git a/layout/svg/crashtests/1758029-1.html b/layout/svg/crashtests/1758029-1.html new file mode 100644 index 0000000000..2097e875ee --- /dev/null +++ b/layout/svg/crashtests/1758029-1.html @@ -0,0 +1,40 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<meta charset="utf-8"> +<style> + body { background: gray; } + canvas { border: 2px solid black;} +</style> + +<img id="img" + onload="go()" + src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAIAAAD8GO2jAAAAKElEQVR42u3NQQ0AAAgEoNP+nTWFDzcoQE1udQQCgUAgEAgEAsGTYAGjxAE/G/Q2tQAAAABJRU5ErkJggg=="> +<canvas id="canvas"></canvas> +<script> + const ctx = canvas.getContext("2d", { desynchronized: true }); + const SVG_FILTER = ` + <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> + <filter id="posterize"> + <feComponentTransfer> + <feFuncR type="discrete" tableValues="0,1" /> + <feFuncG type="discrete" tableValues="0,1" /> + <feFuncB type="discrete" tableValues="0,1" /> + <feFuncA type="discrete" tableValues="0,1" /> + </feComponentTransfer> + </filter> + </svg>`; + + const FILTER1 = `url('data:image/svg+xml;utf8,${SVG_FILTER.replace(/\n/g, "") + .replace(/\s+/g, " ") + .trim()}#posterize') grayscale(50%) brightness(50%)`; + function go() { + canvas.width = img.naturalWidth; + canvas.height = img.naturalHeight; + + ctx.imageSmoothingEnabled = true; + ctx.clearRect(0, 0, canvas.width, canvas.height); + ctx.filter = FILTER1; + ctx.drawImage(img, 0, 0); + setTimeout(() => { document.documentElement.removeAttribute("class")}, 0); + } +</script> diff --git a/layout/svg/crashtests/1764936-1.html b/layout/svg/crashtests/1764936-1.html new file mode 100644 index 0000000000..c03789d547 --- /dev/null +++ b/layout/svg/crashtests/1764936-1.html @@ -0,0 +1,16 @@ +<!DOCTYPE html> +<html> +<head> + <script> + window.addEventListener("load", () => { + const svg = document.createElementNS("http://www.w3.org/2000/svg", "svg") + const image = document.createElementNS("http://www.w3.org/2000/svg", "image") + image.setAttribute("height", "78.04250580135444ch") + image.setAttribute("width", "1024rem") + image.setAttribute("clip-path", "path( evenodd, '\\C' )") + svg.appendChild(image) + document.documentElement.appendChild(svg) + }) + </script> +</head> +</html> diff --git a/layout/svg/crashtests/1804958.html b/layout/svg/crashtests/1804958.html new file mode 100644 index 0000000000..663f621d4c --- /dev/null +++ b/layout/svg/crashtests/1804958.html @@ -0,0 +1,4 @@ +<svg>
+<polygon points="0,2 2,0" marker-end="url(#a)"></polygon>
+<marker id="a" clip-path="">
+<svg style="mix-blend-mode: lighten">
diff --git a/layout/svg/crashtests/1810260.html b/layout/svg/crashtests/1810260.html new file mode 100644 index 0000000000..f555581165 --- /dev/null +++ b/layout/svg/crashtests/1810260.html @@ -0,0 +1,28 @@ +<style> +*:only-child { + display: contents; +} +*:nth-child(1) { + mask: url(data:image/gif;base64,R0lGODlhAQABAAD/ACwAAAAAAQABAAACADs=) repeat-x view-box; +} +</style> +<script> +document.addEventListener('DOMContentLoaded', () => { + document.execCommand("selectAll", false) + document.designMode = "on" + document.execCommand("backColor", false, "red") + document.execCommand("justifyFull", false) +}) +</script> +A +<q contenteditable="true"> +<link> +<svg> +<line></line> +<text white-space="pre-line"> +A +</text> +<defs> +</svg> +A + diff --git a/layout/svg/crashtests/220165-1.svg b/layout/svg/crashtests/220165-1.svg new file mode 100644 index 0000000000..0335f78d41 --- /dev/null +++ b/layout/svg/crashtests/220165-1.svg @@ -0,0 +1,21 @@ +<?xml version="1.0"?>
+
+<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:html="http://www.w3.org/1999/xhtml" height="500"
+ xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ onload="document.documentElement.getBoundingClientRect();
+ document.getElementById('x').textContent = 'New text'">
+
+ <foreignObject x="200" y="180" width="100" height="50" >
+ <html:button id="x">Old long long long text</html:button>
+ </foreignObject>
+
+ <g transform="rotate(10) translate(-100) scale(0.8)">
+ <polygon style="fill:red; fill-opacity:0.5;"
+ points="350, 75 379,161 469,161 397,215
+ 423,301 350,250 277,301 303,215
+ 231,161 321,161" />
+
+ </g>
+
+</svg>
diff --git a/layout/svg/crashtests/267650-1.svg b/layout/svg/crashtests/267650-1.svg new file mode 100644 index 0000000000..3e9c7ecc01 --- /dev/null +++ b/layout/svg/crashtests/267650-1.svg @@ -0,0 +1,4 @@ +<?xml version='1.0'?>
+<svg xmlns='http://www.w3.org/2000/svg'>
+ <text fill='none' stroke='black'>TESTCASE</text>
+</svg>
diff --git a/layout/svg/crashtests/294022-1.svg b/layout/svg/crashtests/294022-1.svg new file mode 100644 index 0000000000..f30b484c83 --- /dev/null +++ b/layout/svg/crashtests/294022-1.svg @@ -0,0 +1,17 @@ +<?xml version="1.0"?> +<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" + "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"> +<svg xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink" + > + + <g> + <clipPath id="action_box_cp"> + <rect width="100" height="46"/> + </clipPath> + <text style="clip-path:url(#action_box_cp); " y="10" id="action_boxtext" pointer-events="none" class="TextBoxText"> + <tspan x="0" dy="0">Action</tspan> + </text> + </g> + +</svg> diff --git a/layout/svg/crashtests/307314-1.svg b/layout/svg/crashtests/307314-1.svg new file mode 100644 index 0000000000..5c538df88d --- /dev/null +++ b/layout/svg/crashtests/307314-1.svg @@ -0,0 +1,9 @@ +<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait" onload="setTimeout(function() { var g = document.getElementById('N1'), h = document.getElementById('N2'); g.appendChild(h); document.documentElement.removeAttribute("class"); }, 20);"> + + <text id="N1"/> + <text id="N2"> + <tspan> + <textPath/> + </tspan> + </text> +</svg> diff --git a/layout/svg/crashtests/308615-1.svg b/layout/svg/crashtests/308615-1.svg new file mode 100644 index 0000000000..fe5391de38 --- /dev/null +++ b/layout/svg/crashtests/308615-1.svg @@ -0,0 +1,10 @@ +<svg xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink"> + + <pattern id="pattern1"> + <rect style="fill:url(#pattern1);"/> + </pattern> + + <rect style="fill:url(#pattern1);" /> + +</svg>
\ No newline at end of file diff --git a/layout/svg/crashtests/308917-1.svg b/layout/svg/crashtests/308917-1.svg new file mode 100644 index 0000000000..7d0ae44f74 --- /dev/null +++ b/layout/svg/crashtests/308917-1.svg @@ -0,0 +1,35 @@ +<?xml version="1.0" encoding="UTF-8"?> + +<svg version="1.1" baseProfile="basic" xmlns="http://www.w3.org/2000/svg" width="100%" height="100%" viewBox="0 0 480 360" class="reftest-wait" onload="first();"> + +<script><![CDATA[ + +function first() +{ + document.getElementById("z").appendChild(document.getElementById("pat1")); + setTimeout(second, 30); +} + +function second() +{ + document.getElementById("pat4").appendChild(document.getElementById("z")); + document.documentElement.removeAttribute("class"); +} + +]]></script> + + + <pattern patternUnits="userSpaceOnUse" id="pat1" x="10" y="10" width="20" height="20"> + <rect x="5" y="5" width="10" height="10" fill="red" /> + <rect x="10" y="10" width="10" height="10" fill="green" /> + </pattern> + <rect x="25" y="10" width="430" height="60" stroke="black" fill="url(#pat1)" /> + + <pattern patternUnits="userSpaceOnUse" id="pat4" x="0" y="0" width="20" height="10"> + <rect x="0" y="0" width="10" height="10" fill="red" /> + <rect x="10" y="0" width="10" height="10" fill="blue" /> + </pattern> + <text font-family="Arial" font-size="40" fill="none" stroke="url(#pat4)" stroke-width="2" x="25" y="275" id="z">Pattern on stroke</text> + +</svg> + diff --git a/layout/svg/crashtests/310436-1.svg b/layout/svg/crashtests/310436-1.svg new file mode 100644 index 0000000000..e6dd5680ce --- /dev/null +++ b/layout/svg/crashtests/310436-1.svg @@ -0,0 +1,28 @@ +<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait"><script><![CDATA[ + +function init() { + var docElt = document.documentElement; + var div1 = document.getElementById("div1"); + var div2 = document.getElementById("div2"); + var textNode = div2.childNodes[0]; + + function first() + { + docElt.appendChild(div2); + div2.appendChild(div1); + } + + function second() + { + div2.appendChild(div1); + div1.appendChild(textNode); + document.documentElement.removeAttribute("class"); + } + + first(); + setTimeout(second, 30); +} + +window.addEventListener("load", init, false); + +]]></script><div xmlns="http://www.w3.org/1999/xhtml" id="div1"><div id="div2">A Z</div></div></svg> diff --git a/layout/svg/crashtests/310638.svg b/layout/svg/crashtests/310638.svg new file mode 100644 index 0000000000..e5ee30fb2c --- /dev/null +++ b/layout/svg/crashtests/310638.svg @@ -0,0 +1,35 @@ +<svg xmlns="http://www.w3.org/2000/svg"><div xmlns='http://www.w3.org/1999/xhtml' id="div1">
+<div id="div2">bar</div> +</div>
+<script><![CDATA[ + +function init() +{ + var div2 = document.getElementById("div2"); + var div1 = document.getElementById("div1"); + var docElt = document.documentElement; + var titleText = document.createTextNode("foo baz"); + + docElt.appendChild(div2);
div2.appendChild(titleText); + + function second () + { + div2.appendChild(div1); + removeNode(titleText); + removeNode(div2); + } + + setTimeout(second, 0); +} + + +function removeNode(q1) { q1.parentNode.removeChild(q1); } + + +setTimeout(init, 0); + + +]]></script> + + +</svg>
\ No newline at end of file diff --git a/layout/svg/crashtests/313737-1.xml b/layout/svg/crashtests/313737-1.xml new file mode 100644 index 0000000000..93421f6077 --- /dev/null +++ b/layout/svg/crashtests/313737-1.xml @@ -0,0 +1,16 @@ +<?xml version="1.0" encoding="ISO-8859-1" standalone="no"?> +<!DOCTYPE xhtml PUBLIC "-//W3C//DTD XHTML 1.1 plus MathML 2.0 plus SVG 1.1//EN" "http://www.w3.org/2002/04/xhtml-math-svg/xhtml-math-svg.dtd" [ +]> + +<html xmlns="http://www.w3.org/1999/xhtml" xmlns:svg="http://www.w3.org/2000/svg" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:xlink="http://www.w3.org/1999/xlink"> + <head> + <title>bug 313737</title> + </head> + <body> + + <svg:svg style="position:fixed;"> + <input type="text" style="position:absolute;" /> + </svg:svg> + + </body> +</html> diff --git a/layout/svg/crashtests/314244-1.xhtml b/layout/svg/crashtests/314244-1.xhtml new file mode 100644 index 0000000000..14717f146d --- /dev/null +++ b/layout/svg/crashtests/314244-1.xhtml @@ -0,0 +1,26 @@ +<?xml version="1.0"?> +<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?> +<!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=314244 --> +<!-- Just checking for lack of crash, nothing more --> + +<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" + title="GMail" + width="300" height="300" + screenX="10" screenY="10"> + + <hbox> + <svg version="1.0" + xmlns="http://www.w3.org/2000/svg" + width="100px" height="100px" + id="back-button" + class="nav-button" + style="display: -moz-box;"> + <rect x="10" y="10" width="80" height="80" fill="blue" /> + </svg> + <spacer flex="1" /> + </hbox> + + <spacer flex="1" /> + +</window> + diff --git a/layout/svg/crashtests/322185-1.svg b/layout/svg/crashtests/322185-1.svg new file mode 100644 index 0000000000..8a10eb34a4 --- /dev/null +++ b/layout/svg/crashtests/322185-1.svg @@ -0,0 +1,6 @@ +<?xml version="1.0"?> +<svg xmlns="http://www.w3.org/2000/svg"> + <g id="g" style="display: -moz-box; overflow: hidden;"> + <circle /> + </g> +</svg> diff --git a/layout/svg/crashtests/322215-1.svg b/layout/svg/crashtests/322215-1.svg new file mode 100644 index 0000000000..f872fbcd8f --- /dev/null +++ b/layout/svg/crashtests/322215-1.svg @@ -0,0 +1,31 @@ +<?xml version="1.0" standalone="no"?> +<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" +"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"> +<!-- This Source Code Form is subject to the terms of the Mozilla Public + - License, v. 2.0. If a copy of the MPL was not distributed with this + - file, You can obtain one at http://mozilla.org/MPL/2.0/. --> +<!-- +Copyright Georgi Guninski +--> + + +<svg width="100%" height="100%" version="1.1" +xmlns="http://www.w3.org/2000/svg"> + +<defs> +<filter id="MyFilter" filterUnits="userSpaceOnUse" +x="0" y="0" width="32769" height="32769"> + +<feGaussianBlur in="SourceAlpha" stdDeviation="4" result="blur"/> + +</filter> +</defs> + +<rect x="1" y="1" width="198" height="118" fill="#cccccc" /> + +<g filter="url(#MyFilter)"> +<text fill="#FFFFFF" stroke="black" font-size="45" +x="42" y="42">Feck b1ll</text> +</g> + +</svg> diff --git a/layout/svg/crashtests/323704-1.svg b/layout/svg/crashtests/323704-1.svg new file mode 100644 index 0000000000..13b8d52243 --- /dev/null +++ b/layout/svg/crashtests/323704-1.svg @@ -0,0 +1,12 @@ +<svg xmlns='http://www.w3.org/2000/svg' +xmlns:xlink='http://www.w3.org/1999/xlink'> + + <clipPath id='clipPath_0'> + <rect x='10' y='10' width='25' height='25' rx='5' ry='5' fill='none' +clip-path='url(#clipPath_0)'/> + </clipPath> + + <rect x='5' y='5' width='35' height='35' fill='red' +clip-path='url(#clipPath_0)'/> + +</svg> diff --git a/layout/svg/crashtests/325427-1.svg b/layout/svg/crashtests/325427-1.svg new file mode 100644 index 0000000000..1f1c645251 --- /dev/null +++ b/layout/svg/crashtests/325427-1.svg @@ -0,0 +1,20 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+ <defs>
+ <g id="module">
+ <use xlink:href="#module" />
+ <use xlink:href="#module" />
+ <use xlink:href="#module" />
+ <use xlink:href="#module" />
+ <use xlink:href="#baseModule" />
+ <use xlink:href="#baseModule" />
+ <use xlink:href="#extendsModule" />
+ <use xlink:href="#extendsModule" />
+ <use xlink:href="#extendsModule" />
+ <use xlink:href="#extendsModule" />
+ <use xlink:href="#extendsModule" />
+ <use xlink:href="#extendsModule" />
+ </g>
+ <use id="baseModule" xlink:href="#module" />
+ <use id="extendsModule" xlink:href="#module" />
+ </defs>
+</svg>
diff --git a/layout/svg/crashtests/326495-1.svg b/layout/svg/crashtests/326495-1.svg new file mode 100644 index 0000000000..a5bf25b62a --- /dev/null +++ b/layout/svg/crashtests/326495-1.svg @@ -0,0 +1,16 @@ +<?xml version="1.0"?> +<svg width="10cm" height="5cm" viewBox="0 0 1000 500" + xmlns="http://www.w3.org/2000/svg" + version="1.1"> + + <script> + function init() + { + document.getElementsByTagName("rect")[0].style.display = "-moz-inline-box"; + } + + window.addEventListener("load", init, false); + </script> + + <rect requiredFeatures="http://www.w3.org/TR/SVG11/feature#SVG-nonexistent-feature"/> +</svg> diff --git a/layout/svg/crashtests/326974-1.svg b/layout/svg/crashtests/326974-1.svg new file mode 100644 index 0000000000..750165b730 --- /dev/null +++ b/layout/svg/crashtests/326974-1.svg @@ -0,0 +1,21 @@ +<?xml version="1.0" encoding="UTF-8"?>
+ +<svg xmlns="http://www.w3.org/2000/svg">
+ +<script> + +function init() {
var n2 = document.getElementById("n2"); + var n3 = document.getElementById("n3"); + + n2.appendChild(n3); +}
+ +window.addEventListener("load", init, false); + +</script> + +
+<g id="n2">
<text id="n3" /> +</g>
+ +</svg>
\ No newline at end of file diff --git a/layout/svg/crashtests/327706-1.svg b/layout/svg/crashtests/327706-1.svg new file mode 100644 index 0000000000..9aae909250 --- /dev/null +++ b/layout/svg/crashtests/327706-1.svg @@ -0,0 +1,9 @@ +<?xml version="1.0" encoding="Windows-1252"?> +<svg xmlns="http://www.w3.org/2000/svg"> + +<script> + +document.documentElement.unsuspendRedraw(6) + +</script> +</svg> diff --git a/layout/svg/crashtests/327711-1.svg b/layout/svg/crashtests/327711-1.svg new file mode 100644 index 0000000000..d919b866f6 --- /dev/null +++ b/layout/svg/crashtests/327711-1.svg @@ -0,0 +1,19 @@ +<?xml version="1.0" encoding="UTF-8"?>
+ +<svg xmlns="http://www.w3.org/2000/svg"> + +<script>
+ +function init() +{
+ document.documentElement.unsuspendRedrawAll(); + document.getElementsByTagName("text")[0].firstChild.data = "Quux"; +}
+ +window.addEventListener("load", init, false); + +</script> + +<text x="125" y="30">Foo</text>
+ +</svg>
\ No newline at end of file diff --git a/layout/svg/crashtests/328137-1.svg b/layout/svg/crashtests/328137-1.svg new file mode 100644 index 0000000000..26190b1eb0 --- /dev/null +++ b/layout/svg/crashtests/328137-1.svg @@ -0,0 +1,24 @@ +<?xml version="1.0" encoding="UTF-8"?> + +<svg xmlns="http://www.w3.org/2000/svg"> + +<script> + + +function init() +{ + x = document.getElementsByTagName("stop"); + x[0].appendChild(x[1]); +} + + +window.addEventListener("load", init, false); + +</script> + +<radialGradient> + <stop/> + <stop/> +</radialGradient> + +</svg> diff --git a/layout/svg/crashtests/329848-1.svg b/layout/svg/crashtests/329848-1.svg new file mode 100644 index 0000000000..ac4f0022e1 --- /dev/null +++ b/layout/svg/crashtests/329848-1.svg @@ -0,0 +1 @@ +<svg xmlns="http://www.w3.org/2000/svg">
<polygon transform="?" points="100,100 200,100 150,200"/>
</svg>
\ No newline at end of file diff --git a/layout/svg/crashtests/337408-1.xhtml b/layout/svg/crashtests/337408-1.xhtml new file mode 100644 index 0000000000..f56c06ec94 --- /dev/null +++ b/layout/svg/crashtests/337408-1.xhtml @@ -0,0 +1,21 @@ +<?xml version="1.0"?> +<!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=337408 --> +<!-- Just checking for lack of crash, nothing more --> +<window id="svg-in-xul-stack" + xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" + xmlns:svg="http://www.w3.org/2000/svg" + style="background-color:white;" + screenX="20" + screenY="20" + width="600" + height="400"> + + <stack> + <box flex="1"> + <label value="foo"/> + </box> + <svg:svg> + <svg:rect width="100%" height="100%" fill="red" fill-opacity="0.5"/> + </svg:svg> + </stack> +</window> diff --git a/layout/svg/crashtests/338301-1.xhtml b/layout/svg/crashtests/338301-1.xhtml new file mode 100644 index 0000000000..3367eedebb --- /dev/null +++ b/layout/svg/crashtests/338301-1.xhtml @@ -0,0 +1,13 @@ +<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de"> +<body> + + <svg xmlns="http://www.w3.org/2000/svg"> + <defs> + <linearGradient> + <path/> + </linearGradient> + </defs> + </svg> + +</body> +</html> diff --git a/layout/svg/crashtests/338312-1.xhtml b/layout/svg/crashtests/338312-1.xhtml new file mode 100644 index 0000000000..5a751a2ae0 --- /dev/null +++ b/layout/svg/crashtests/338312-1.xhtml @@ -0,0 +1,28 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script> + + +function boom() +{ + document.getElementById("foo").appendChild(document.getElementById("bar")); +} + +window.addEventListener("load", boom, false); + +</script> +</head> + +<body> + + <div id="foo"></div> + + <svg xmlns="http://www.w3.org/2000/svg"> + <defs> + <linearGradient id="grad1"/> + </defs> + <rect id="bar" style="fill:url(#grad1);" /> + </svg> + +</body> +</html> diff --git a/layout/svg/crashtests/340083-1.svg b/layout/svg/crashtests/340083-1.svg new file mode 100644 index 0000000000..7f015b6efe --- /dev/null +++ b/layout/svg/crashtests/340083-1.svg @@ -0,0 +1,9 @@ +<?xml version="1.0" encoding="UTF-8"?> + +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="100%" height="100%"> + <defs> + <title> + <image x="30" y="0" width="190" height="190" xlink:href="../../../testing/crashtest/images/tree.gif"/> + </title> + </defs> +</svg> diff --git a/layout/svg/crashtests/340945-1.svg b/layout/svg/crashtests/340945-1.svg new file mode 100644 index 0000000000..01ac66fb33 --- /dev/null +++ b/layout/svg/crashtests/340945-1.svg @@ -0,0 +1,2 @@ +<svg xmlns="http://www.w3.org/2000/svg" style="display: table;"> +</svg> diff --git a/layout/svg/crashtests/342923-1.html b/layout/svg/crashtests/342923-1.html new file mode 100644 index 0000000000..bed6e89791 --- /dev/null +++ b/layout/svg/crashtests/342923-1.html @@ -0,0 +1,23 @@ +<html> +<head> +<script> + +function boo() +{ + var rect = document.createElementNS("http://www.w3.org/2000/svg", "rect"); + rect.setAttribute("stroke", "blue"); + + document.body.appendChild(rect); +} + +</script> +</head> + +<body class="bodytext" onload="boo();"> + +<div id="c1"></div> + +<p>In a debug trunk build from 2006-006-27, loading this page triggers an assertion. (It also triggers a CSS error in the console, but I think that's a known, separate bug.)</p> + +</body> +</html> diff --git a/layout/svg/crashtests/343221-1.xhtml b/layout/svg/crashtests/343221-1.xhtml new file mode 100644 index 0000000000..890b161dfe --- /dev/null +++ b/layout/svg/crashtests/343221-1.xhtml @@ -0,0 +1,20 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait"> +<head> +<script> + +function boo() +{ + document.getElementById("c").style.overflow = "hidden"; + document.documentElement.removeAttribute("class"); +} + +</script> +</head> +<body onload="setTimeout(boo, 30);"> + +<svg xmlns="http://www.w3.org/2000/svg"> + <circle id="c" cx="50" cy="50" r="20" /> +</svg> + +</body> +</html> diff --git a/layout/svg/crashtests/344749-1.svg b/layout/svg/crashtests/344749-1.svg new file mode 100644 index 0000000000..1a02d7c180 --- /dev/null +++ b/layout/svg/crashtests/344749-1.svg @@ -0,0 +1,11 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + + +<circle cx="6cm" cy="2cm" r="100" fill="red" transform="translate(0,50)" /> +<circle cx="6cm" cy="2cm" r="100" fill="blue" transform="translate(70,150)" /> +<circle cx="6cm" cy="2cm" r="100" fill="green" transform="translate(-70,150)" /> + +<rect id="rect1" fill="url(#pat0)"/> + +<pattern patternUnits="userSpaceOnUse" id="pat0" x="10" y="10" width="20" height="20">
<rect x="5" y="5" width="10" height="10" fill="red" />
<rect x="10" y="10" width="10" height="10" fill="green" />
</pattern>
+
</svg> diff --git a/layout/svg/crashtests/344887-1.svg b/layout/svg/crashtests/344887-1.svg new file mode 100644 index 0000000000..f0bd21c592 --- /dev/null +++ b/layout/svg/crashtests/344887-1.svg @@ -0,0 +1,18 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:html="http://www.w3.org/1999/xhtml" onload="setTimeout(foo, 30);" class="reftest-wait"> + +<script> + +var SVG_NS = "http://www.w3.org/2000/svg"; + +function foo() +{ + var rect = document.createElementNS(SVG_NS, 'rect'); + rect.setAttribute('opacity', ".3"); + document.documentElement.appendChild(rect); + document.documentElement.removeAttribute("class"); +} + +</script> + + +</svg>
\ No newline at end of file diff --git a/layout/svg/crashtests/344892-1.svg b/layout/svg/crashtests/344892-1.svg new file mode 100644 index 0000000000..a38d7eb40f --- /dev/null +++ b/layout/svg/crashtests/344892-1.svg @@ -0,0 +1,5 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<text stroke-width="50%">foo</text> + +</svg>
\ No newline at end of file diff --git a/layout/svg/crashtests/344898-1.svg b/layout/svg/crashtests/344898-1.svg new file mode 100644 index 0000000000..34c3f45a4e --- /dev/null +++ b/layout/svg/crashtests/344898-1.svg @@ -0,0 +1,19 @@ +<svg xmlns="http://www.w3.org/2000/svg" onload="setTimeout(removeText, 30);" class="reftest-wait"> + + +<script> + +function removeText() +{ + var x = document.getElementById("textPath"); + x.removeChild(x.firstChild); + document.documentElement.removeAttribute("class"); +} + +</script> + + +<text x="30" y="30"><textPath id="textPath">Foo</textPath></text> + + +</svg>
\ No newline at end of file diff --git a/layout/svg/crashtests/344904-1.svg b/layout/svg/crashtests/344904-1.svg new file mode 100644 index 0000000000..a2c8d07647 --- /dev/null +++ b/layout/svg/crashtests/344904-1.svg @@ -0,0 +1,19 @@ +<svg xmlns="http://www.w3.org/2000/svg" onload="setTimeout(boom, 30);" class="reftest-wait"> + +<script> + +function boom() +{ + document.getElementById("m").setAttribute("stroke-miterlimit", 1); + document.documentElement.removeAttribute("class"); +} + +</script> + + +<marker> + <path id="m" /> +</marker> + + +</svg> diff --git a/layout/svg/crashtests/345418-1.svg b/layout/svg/crashtests/345418-1.svg new file mode 100644 index 0000000000..2cf8b331fa --- /dev/null +++ b/layout/svg/crashtests/345418-1.svg @@ -0,0 +1,4 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<tspan>arg</tspan> +
</svg>
\ No newline at end of file diff --git a/layout/svg/crashtests/348982-1.xhtml b/layout/svg/crashtests/348982-1.xhtml new file mode 100644 index 0000000000..ad0340689a --- /dev/null +++ b/layout/svg/crashtests/348982-1.xhtml @@ -0,0 +1,20 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> + +<head> +<style> +#div, #svg { display: table; } +#g { display: inline; } +</style> +</head> + +<body> + <div id="div"> + <svg id="svg" xmlns="http://www.w3.org/2000/svg"> + <g id="g"> + <circle cx="6.5cm" cy="2cm" r="100" style="fill: blue;" /> + </g> + </svg> + </div> +</body> + +</html> diff --git a/layout/svg/crashtests/354777-1.xhtml b/layout/svg/crashtests/354777-1.xhtml new file mode 100644 index 0000000000..e82baf34c9 --- /dev/null +++ b/layout/svg/crashtests/354777-1.xhtml @@ -0,0 +1,28 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> + +<head> +<script> + +var SVG_NS = "http://www.w3.org/2000/svg"; + +function boom() +{ + var svgElem = document.createElementNS(SVG_NS, "svg"); + var ellipse = document.createElementNS(SVG_NS, "ellipse"); + + svgElem.setAttribute("viewBox", "0 0 30 40"); + document.body.appendChild(svgElem); + document.body.appendChild(ellipse); + ellipse.appendChild(svgElem); + svgElem.removeAttribute("viewBox"); +} + +</script> +</head> + +<body onload="boom()"> + +</body> + +</html> + diff --git a/layout/svg/crashtests/359516-1.svg b/layout/svg/crashtests/359516-1.svg new file mode 100644 index 0000000000..c997eb3a85 --- /dev/null +++ b/layout/svg/crashtests/359516-1.svg @@ -0,0 +1,36 @@ +<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:html="http://www.w3.org/1999/xhtml"
+ class="reftest-wait"
+ onload="setTimeout(doStuff, 30);">
+
+<html:script style="display: none;" type="text/javascript">
+
+function doStuff()
+{
+ var svg = document.documentElement;
+ var ellipse = document.getElementById("ellipse");
+ var filter = document.getElementById("filter");
+
+ document.addEventListener("DOMNodeRemoved", foopy, false);
+ filter.removeChild(filter.firstChild);
+ document.removeEventListener("DOMNodeRemoved", foopy, false);
+
+ function foopy()
+ {
+ document.removeEventListener("DOMNodeRemoved", foopy, false);
+ svg.appendChild(filter);
+ }
+
+ // Needed for the crash, but not for the assertion.
+ svg.appendChild(ellipse);
+
+ document.documentElement.removeAttribute("class");
+}
+
+</html:script>
+
+<ellipse id="ellipse" cx="200" cy="150" rx="70" ry="40" style="filter: url(#filter);"/>
+
+<filter id="filter"> </filter>
+
+</svg>
diff --git a/layout/svg/crashtests/361015-1.svg b/layout/svg/crashtests/361015-1.svg new file mode 100644 index 0000000000..8ac4bc56f2 --- /dev/null +++ b/layout/svg/crashtests/361015-1.svg @@ -0,0 +1,33 @@ +<svg xmlns="http://www.w3.org/2000/svg" + xmlns:html="http://www.w3.org/1999/xhtml" + class="reftest-wait" + onload="setTimeout(boom, 30)"> + +<html:script> +<![CDATA[ + +function boom() +{ + var grad = document.getElementById("grad"); + var g = document.getElementById("g"); + grad.appendChild(g); + g.removeAttribute("transform"); + document.documentElement.removeAttribute("class"); +} + +]]> +</html:script> + + + <g id="g" transform="translate(500,0)"> + <text x="25" y="85">Foo</text> + </g> + + + <linearGradient id="grad" gradientUnits="objectBoundingBox" x1="0" y1="0" x2="1" y2="1"> + <stop stop-color="blue" offset="0.2"/> + <stop stop-color="lime" offset="0.4"/> + </linearGradient> + + +</svg> diff --git a/layout/svg/crashtests/361587-1.svg b/layout/svg/crashtests/361587-1.svg new file mode 100644 index 0000000000..52bce9eda7 --- /dev/null +++ b/layout/svg/crashtests/361587-1.svg @@ -0,0 +1,31 @@ +<svg xmlns="http://www.w3.org/2000/svg" + onload="setTimeout(boom, 30);" + class="reftest-wait"> + +<script style="display: none" type="text/javascript"> +<![CDATA[ + +function boom() +{ + var oldGrad = document.getElementById("grad"); + oldGrad.parentNode.removeChild(oldGrad); + + var newGrad = document.createElementNS("http://www.w3.org/2000/svg", "radialGradient"); + newGrad.setAttribute("gradientUnits", "userSpaceOnUse"); + newGrad.setAttribute("id", "grad"); + + document.documentElement.appendChild(newGrad); + + document.documentElement.removeAttribute("class"); +} + +]]> +</script> + + <radialGradient id="grad" gradientUnits="userSpaceOnUse" cx="240" cy="210" r="220" fx="240" fy="210"> + <stop stop-color="yellow" offset="0"/> + <stop stop-color="green" offset="1"/> + </radialGradient> + <rect x="20" y="150" width="440" height="80" fill="url(#grad)" stroke-width="40"/> + +</svg> diff --git a/layout/svg/crashtests/363611-1.xhtml b/layout/svg/crashtests/363611-1.xhtml new file mode 100644 index 0000000000..6bc386bcdf --- /dev/null +++ b/layout/svg/crashtests/363611-1.xhtml @@ -0,0 +1,21 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> + +<script style="display: none" type="text/javascript"> + +function boom() +{ + var fo = document.createElementNS("http://www.w3.org/2000/svg", 'foreignObject'); + document.getElementById("innerSVG").appendChild(fo); +} + +</script> + +</head> + +<body onload="boom();"> + +<svg xmlns="http://www.w3.org/2000/svg" ><linearGradient><svg id="innerSVG"></svg></linearGradient></svg> + +</body> +</html> diff --git a/layout/svg/crashtests/364688-1.svg b/layout/svg/crashtests/364688-1.svg new file mode 100644 index 0000000000..045061cd2f --- /dev/null +++ b/layout/svg/crashtests/364688-1.svg @@ -0,0 +1,34 @@ +<svg xmlns="http://www.w3.org/2000/svg" + xmlns:html="http://www.w3.org/1999/xhtml" + onload="setTimeout(boom, 30);" + class="reftest-wait"> + +<script> +function boom() +{ + document.getElementById("sss").removeAttribute('value'); + + document.documentElement.removeAttribute("class"); +} +</script> + + +<foreignObject width="500" height="500" y="300"> + +<div xmlns="http://www.w3.org/1999/xhtml"> + +<table border="1"> + <tr> + <td>Foo</td> + </tr> + <tr> + <td><input type="text" value="Baz" id="sss" /></td> + </tr> +</table> + +</div> + +</foreignObject> + + +</svg> diff --git a/layout/svg/crashtests/366956-1.svg b/layout/svg/crashtests/366956-1.svg new file mode 100644 index 0000000000..9836c7ea3a --- /dev/null +++ b/layout/svg/crashtests/366956-1.svg @@ -0,0 +1,61 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:html="http://www.w3.org/1999/xhtml" onload="setTimeout(boom1, 50);" class="reftest-wait"> + +<html:script> + +function boom1() +{ + document.getElementsByTagName("mi")[0].setAttribute('id', "ffff"); + + document.getElementById("fo").appendChild(document.createTextNode(" ")); + + setTimeout(boom2, 50); +} + +function boom2() +{ + var fodiv = document.getElementById("fodiv"); + fodiv.parentNode.removeChild(fodiv); + + document.documentElement.removeAttribute("class"); +} + +</html:script> + + + <g> + <foreignObject width="500" height="500" transform="scale(.7,.7)" id="fo" y="300"> + +<div id="fodiv" xmlns="http://www.w3.org/1999/xhtml"> + + + +<p>0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 990 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 990 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 990 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99</p> + + + +<div><math xmlns="http://www.w3.org/1998/Math/MathML" display="block"> +<mrow> + <mi>A</mi> +</mrow> +</math></div> + + +<svg xmlns="http://www.w3.org/2000/svg" id="svg" viewbox="0 0 250 250" width="100" height="100"> + <style type="text/css"> + circle:hover {fill-opacity:0.9;} + </style> + + <g style="fill-opacity:0.7;" transform="scale(.2)"> + <circle cx="6.5cm" cy="2cm" r="100" style="fill:red; stroke:black; stroke-width:0.1cm" transform="translate(0,50)" /> + <circle cx="6.5cm" cy="2cm" r="100" style="fill:blue; stroke:black; stroke-width:0.1cm" transform="translate(70,150)" /> + <circle cx="6.5cm" cy="2cm" r="100" style="fill:green; stroke:black; stroke-width:0.1cm" transform="translate(-70,150)"/> + </g> +</svg> + +</div> +</foreignObject> +</g> + + + +</svg> diff --git a/layout/svg/crashtests/366956-2.svg b/layout/svg/crashtests/366956-2.svg new file mode 100644 index 0000000000..a2ab21ed55 --- /dev/null +++ b/layout/svg/crashtests/366956-2.svg @@ -0,0 +1,61 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:html="http://www.w3.org/1999/xhtml" onload="setTimeout(boom1, 30);" class="reftest-wait"> + +<html:script> + +function boom1() +{ + document.getElementsByTagName("mi")[0].setAttribute('id', "ffff"); + + document.getElementById("fo").appendChild(document.createTextNode(" ")); + + boom2(); +} + +function boom2() +{ + var fodiv = document.getElementById("fodiv"); + fodiv.parentNode.removeChild(fodiv); + + document.documentElement.removeAttribute("class"); +} + +</html:script> + + + <g> + <foreignObject width="500" height="500" transform="scale(.7,.7)" id="fo" y="300"> + +<div id="fodiv" xmlns="http://www.w3.org/1999/xhtml"> + + + +<p>0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 990 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 990 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 990 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99</p> + + + +<div><math xmlns="http://www.w3.org/1998/Math/MathML" display="block"> +<mrow> + <mi>A</mi> +</mrow> +</math></div> + + +<svg xmlns="http://www.w3.org/2000/svg" id="svg" viewbox="0 0 250 250" width="100" height="100"> + <style type="text/css"> + circle:hover {fill-opacity:0.9;} + </style> + + <g style="fill-opacity:0.7;" transform="scale(.2)"> + <circle cx="6.5cm" cy="2cm" r="100" style="fill:red; stroke:black; stroke-width:0.1cm" transform="translate(0,50)" /> + <circle cx="6.5cm" cy="2cm" r="100" style="fill:blue; stroke:black; stroke-width:0.1cm" transform="translate(70,150)" /> + <circle cx="6.5cm" cy="2cm" r="100" style="fill:green; stroke:black; stroke-width:0.1cm" transform="translate(-70,150)"/> + </g> +</svg> + +</div> +</foreignObject> +</g> + + + +</svg> diff --git a/layout/svg/crashtests/367111-1.svg b/layout/svg/crashtests/367111-1.svg new file mode 100644 index 0000000000..dcf6a39bf7 --- /dev/null +++ b/layout/svg/crashtests/367111-1.svg @@ -0,0 +1,29 @@ +<svg xmlns="http://www.w3.org/2000/svg" + xmlns:html="http://www.w3.org/1999/xhtml" + onload="setTimeout(boom, 30);" + class="reftest-wait"> + +<html:script> + +function boom() +{ + document.getElementById("text").appendChild(document.getElementById("fo")); + + document.documentElement.removeAttribute("class"); +} + +</html:script> + +<defs> + <marker> + <text id="text">svg:text</text> + </marker> +</defs> + +<foreignObject id="fo"> + <div xmlns="http://www.w3.org/1999/xhtml"> + <p>HTML in a foreignObject</p> + </div> +</foreignObject> + +</svg> diff --git a/layout/svg/crashtests/367368-1.xhtml b/layout/svg/crashtests/367368-1.xhtml new file mode 100644 index 0000000000..b9bcd3241b --- /dev/null +++ b/layout/svg/crashtests/367368-1.xhtml @@ -0,0 +1,12 @@ +<!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=367368 --> +<!-- Just checking for crash, nothing more --> + +<html xmlns="http://www.w3.org/1999/xhtml"> + <body> + + <svg xmlns="http://www.w3.org/2000/svg"> + <circle cx="6.5cm" cy="2cm" r="100" style="fill:red; stroke:black;" transform="translate(0,50)" /> + </svg> + + </body> +</html> diff --git a/layout/svg/crashtests/369233-1.svg b/layout/svg/crashtests/369233-1.svg new file mode 100644 index 0000000000..22f4aacb37 --- /dev/null +++ b/layout/svg/crashtests/369233-1.svg @@ -0,0 +1,33 @@ +<svg xmlns="http://www.w3.org/2000/svg" + xmlns:html="http://www.w3.org/1999/xhtml" + onload="setTimeout(boom, 200);" + class="reftest-wait"> + +<html:script> + +function boom() +{ + try { + document.getElementById("grad2").gradientUnits.baseVal = "y"; + } catch (e) { + } + + document.documentElement.removeAttribute("class"); +} + +</html:script> + + + +<radialGradient id="grad2" gradientUnits="userSpaceOnUse" cx="240" cy="210" r="220" fx="240" fy="210"> + <stop stop-color="black" offset="0"/> + <stop stop-color="yellow" offset="0.2"/> + <stop stop-color="red" offset="0.4"/> + <stop stop-color="blue" offset="0.6"/> + <stop stop-color="white" offset="0.8"/> + <stop stop-color="green" offset="1"/> +</radialGradient> + +<rect x="20" y="150" width="440" height="80" fill="url(#grad2)" stroke-width="40"/> + +</svg> diff --git a/layout/svg/crashtests/369438-1.svg b/layout/svg/crashtests/369438-1.svg new file mode 100644 index 0000000000..78bcb6b54d --- /dev/null +++ b/layout/svg/crashtests/369438-1.svg @@ -0,0 +1,24 @@ +<svg width="100%" height="100%" version="1.1"
+xmlns="http://www.w3.org/2000/svg" xmlns:html="http://www.w3.org/1999/xhtml" onload="setTimeout(boom, 30);" class="reftest-wait"><html:script src="data:text/javascript,"></html:script><html:script>
+
+function boom()
+{
+ var defs = document.getElementById("defs");
+ defs.parentNode.removeChild(defs);
+
+ document.documentElement.removeAttribute("class");
+}
+
+</html:script>
+
+<defs id="defs">
+<filter id="Gaussian_Blur">
+<feGaussianBlur in="SourceGraphic" stdDeviation="3"/>
+</filter>
+</defs>
+
+<ellipse cx="200" cy="150" rx="70" ry="40"
+style="fill:#ff0000;stroke:#000000;
+stroke-width:2;filter:url(#Gaussian_Blur)"/>
+
+</svg>
diff --git a/layout/svg/crashtests/369438-2.svg b/layout/svg/crashtests/369438-2.svg new file mode 100644 index 0000000000..92eea9ee0f --- /dev/null +++ b/layout/svg/crashtests/369438-2.svg @@ -0,0 +1,27 @@ +<svg width="100%" height="100%" version="1.1"
+xmlns="http://www.w3.org/2000/svg" xmlns:html="http://www.w3.org/1999/xhtml" onload="setTimeout(boom, 30);" class="reftest-wait"><html:script>
+
+function boom()
+{
+ var defs = document.getElementById("defs");
+ var gb = document.getElementById("Gaussian_Blur");
+
+ defs.parentNode.removeChild(defs);
+ gb.removeChild(gb.firstChild); // remove a whitespace text node (!)
+
+ document.documentElement.removeAttribute("class");
+}
+
+</html:script>
+
+<defs id="defs">
+<filter id="Gaussian_Blur">
+<feGaussianBlur in="SourceGraphic" stdDeviation="3"/>
+</filter>
+</defs>
+
+<ellipse cx="200" cy="150" rx="70" ry="40"
+style="fill:#ff0000;stroke:#000000;
+stroke-width:2;filter:url(#Gaussian_Blur)"/>
+
+</svg>
diff --git a/layout/svg/crashtests/371463-1.xhtml b/layout/svg/crashtests/371463-1.xhtml new file mode 100644 index 0000000000..461fb27ba3 --- /dev/null +++ b/layout/svg/crashtests/371463-1.xhtml @@ -0,0 +1,8 @@ +<html xmlns="http://www.w3.org/1999/xhtml"
+ xmlns:svg="http://www.w3.org/2000/svg">
+<body>
+
+<select><svg:svg><svg:foreignObject/></svg:svg></select>
+
+</body>
+</html>
diff --git a/layout/svg/crashtests/371563-1.xhtml b/layout/svg/crashtests/371563-1.xhtml new file mode 100644 index 0000000000..0ebdc9bfa1 --- /dev/null +++ b/layout/svg/crashtests/371563-1.xhtml @@ -0,0 +1,32 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait"> +<head> +<script> + +function boom() +{ + document.getElementById("sdiv").style.overflow = "scroll"; + + document.documentElement.removeAttribute("class"); +} + + +</script> +</head> + +<body onload="setTimeout(boom, 30);"> + + <div id="sdiv" style="float: left;"> + + <svg xmlns="http://www.w3.org/2000/svg" height="400px" width="400px" + y="0.0000000" x="0.0000000" version="1.0" > + <defs> + <marker id="Arrow"/> + </defs> + <path style="marker-end:url(#Arrow)" + d="M 12.500000,200.00000 L 387.50000,200.00000" /> + </svg> + + </div> + +</body> +</html> diff --git a/layout/svg/crashtests/375775-1.svg b/layout/svg/crashtests/375775-1.svg new file mode 100644 index 0000000000..cd17c85a94 --- /dev/null +++ b/layout/svg/crashtests/375775-1.svg @@ -0,0 +1,23 @@ +<svg xmlns="http://www.w3.org/2000/svg" onload="setTimeout(boom, 30);" class="reftest-wait"> + +<script type="text/javascript"> + +function boom() +{ + document.getElementById("filter").style.display = "none"; + document.getElementById("path").style.display = "none"; + + document.documentElement.removeAttribute("class"); +} + +</script> + +<filter id="filter" filterUnits="userSpaceOnUse" x="0" y="0" width="200" height="120" /> + +<g filter="url(#filter)"> + <path id="path" + fill="black" + d="M60,80 C30,80 30,40 60,40 L140,40 C170,40 170,80 140,80 z" /> +</g> + +</svg> diff --git a/layout/svg/crashtests/378716.svg b/layout/svg/crashtests/378716.svg new file mode 100644 index 0000000000..b6faa00284 --- /dev/null +++ b/layout/svg/crashtests/378716.svg @@ -0,0 +1,4 @@ +<svg width="100%" height="100%" x="0" y="0" viewBox="0 0 1 1" + xmlns="http://www.w3.org/2000/svg"> + <text id="text_1" x="0.5" y="0.5" font-size="0.05" fill="green">Okay Text</text> +</svg>
\ No newline at end of file diff --git a/layout/svg/crashtests/380691-1.svg b/layout/svg/crashtests/380691-1.svg new file mode 100644 index 0000000000..ed28552633 --- /dev/null +++ b/layout/svg/crashtests/380691-1.svg @@ -0,0 +1,4 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <mask id="m"/> + <foreignObject mask="url(#m)"/> +</svg> diff --git a/layout/svg/crashtests/384391-1.xhtml b/layout/svg/crashtests/384391-1.xhtml new file mode 100644 index 0000000000..12c657a48c --- /dev/null +++ b/layout/svg/crashtests/384391-1.xhtml @@ -0,0 +1,20 @@ +<html xmlns="http://www.w3.org/1999/xhtml" xmlns:svg="http://www.w3.org/2000/svg" > +<head> +<script> + +function boom() +{ + var circle = document.getElementById("circle"); + document.removeChild(document.documentElement); + document.appendChild(circle); +} + +</script> +</head> + +<body onload="boom()"> + +<svg:circle id="circle" /> + +</body> +</html> diff --git a/layout/svg/crashtests/384499-1.svg b/layout/svg/crashtests/384499-1.svg new file mode 100644 index 0000000000..f448910008 --- /dev/null +++ b/layout/svg/crashtests/384499-1.svg @@ -0,0 +1,20 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:html="http://www.w3.org/1999/xhtml"> + +<html:style> + #mathy { display: table} +</html:style> + +<foreignObject width="500" height="500" y="50"> + <div xmlns="http://www.w3.org/1999/xhtml"> + <p>Foo</p> + <div> + <math xmlns="http://www.w3.org/1998/Math/MathML" id="mathy" display="block"> + <mrow> + <mi>x</mi> + </mrow> + </math> + </div> + </div> +</foreignObject> + +</svg> diff --git a/layout/svg/crashtests/384637-1.svg b/layout/svg/crashtests/384637-1.svg new file mode 100644 index 0000000000..263a2d556a --- /dev/null +++ b/layout/svg/crashtests/384637-1.svg @@ -0,0 +1,9 @@ +<svg xmlns="http://www.w3.org/2000/svg" baseProfile="basic" width="100%" height="100%" viewBox="0 0 480 360">
+
+ <mask id="mask1" maskUnits="userSpaceOnUse" x="60" y="50" width="100" height="60">
+ <rect x="60" y="50" width="100" height="60" fill="yellow" mask="url(#mask1)"/>
+ </mask>
+
+ <rect x="60" y="50" width="100" height="60" fill="lime" mask="url(#mask1)"/>
+
+</svg>
diff --git a/layout/svg/crashtests/384728-1.svg b/layout/svg/crashtests/384728-1.svg new file mode 100644 index 0000000000..ccafc83706 --- /dev/null +++ b/layout/svg/crashtests/384728-1.svg @@ -0,0 +1,21 @@ +<svg xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg" onload="boom();">
+
+<script>
+
+function boom()
+{
+ document.getElementById("thhh").setAttributeNS("http://www.w3.org/1999/xlink", 'href', '');
+}
+
+</script>
+
+ <defs>
+ <g id="ch" style="counter-reset: c;">
+ <rect x="75" y="0" width="75" height="75" fill="lightgreen" style="counter-increment: c;"/>
+ </g>
+
+ </defs>
+
+ <use id="thhh" x="0" y="0"><use xlink:href="#ch" x="0" y="0"/></use>
+
+</svg>
diff --git a/layout/svg/crashtests/385246-1.svg b/layout/svg/crashtests/385246-1.svg new file mode 100644 index 0000000000..cddad0c5e4 --- /dev/null +++ b/layout/svg/crashtests/385246-1.svg @@ -0,0 +1,9 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<foreignObject x="100" y="100" width="-2" height="500"> + <div xmlns="http://www.w3.org/1999/xhtml"> + <p>Foo</p> + </div> +</foreignObject> + +</svg> diff --git a/layout/svg/crashtests/385246-2.svg b/layout/svg/crashtests/385246-2.svg new file mode 100644 index 0000000000..c392f2fc8a --- /dev/null +++ b/layout/svg/crashtests/385246-2.svg @@ -0,0 +1,15 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> + +<script type="text/javascript" xlink:href="data:text/javascript,"></script> + + +<foreignObject width="-2" height="500" id="fo" x="300"> + <div xmlns="http://www.w3.org/1999/xhtml"> + <p>Hi!!!</p> + </div> +</foreignObject> + + + + +</svg> diff --git a/layout/svg/crashtests/385552-1.svg b/layout/svg/crashtests/385552-1.svg new file mode 100644 index 0000000000..019e249d77 --- /dev/null +++ b/layout/svg/crashtests/385552-1.svg @@ -0,0 +1,4 @@ +<?xml version="1.0" encoding="Windows-1252"?> +<script> +document.createElementNS("http://www.w3.org/2000/svg", "svg").unsuspendRedrawAll(); +</script> diff --git a/layout/svg/crashtests/385552-2.svg b/layout/svg/crashtests/385552-2.svg new file mode 100644 index 0000000000..9a93d657fb --- /dev/null +++ b/layout/svg/crashtests/385552-2.svg @@ -0,0 +1,4 @@ +<?xml version="1.0" encoding="Windows-1252"?> +<script> +document.createElementNS("http://www.w3.org/2000/svg", "svg").suspendRedraw(3); +</script> diff --git a/layout/svg/crashtests/385840-1.svg b/layout/svg/crashtests/385840-1.svg new file mode 100644 index 0000000000..cf7ff6949c --- /dev/null +++ b/layout/svg/crashtests/385840-1.svg @@ -0,0 +1,20 @@ +<svg width="100%" height="100%" xmlns="http://www.w3.org/2000/svg" onload="boom();">
+
+<script>
+
+function boom()
+{
+ var SVG_NS = "http://www.w3.org/2000/svg";
+
+ var svgCircle = document.createElementNS(SVG_NS, 'circle');
+ var svgText = document.createElementNS(SVG_NS, 'text');
+ svgText.appendChild(document.createTextNode("foo"));
+ svgCircle.appendChild(svgText);
+
+ document.removeChild(document.documentElement);
+ document.appendChild(svgCircle);
+}
+
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/385852-1.svg b/layout/svg/crashtests/385852-1.svg new file mode 100644 index 0000000000..17ad99ca8f --- /dev/null +++ b/layout/svg/crashtests/385852-1.svg @@ -0,0 +1,34 @@ +<svg width="100%" height="100%" xmlns="http://www.w3.org/2000/svg" onload="setTimeout(boom, 30)" class="reftest-wait">
+
+<script>
+
+var originalRoot = document.documentElement;
+var svgCircle;
+
+function boom()
+{
+ var SVG_NS = "http://www.w3.org/2000/svg";
+
+ var svgPolyline = document.createElementNS(SVG_NS, 'polyline');
+ svgCircle = document.createElementNS(SVG_NS, 'circle');
+
+ svgCircle.appendChild(svgPolyline);
+
+ document.removeChild(originalRoot);
+ document.appendChild(svgCircle);
+
+ setTimeout(restore, 30);
+}
+
+function restore()
+{
+ // We have to put it the root element back in the document so that reftest.js
+ // sees the event for the removal of class="reftest-wait"!
+ document.removeChild(svgCircle);
+ document.appendChild(originalRoot);
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/386475-1.xhtml b/layout/svg/crashtests/386475-1.xhtml new file mode 100644 index 0000000000..4d1b9a2808 --- /dev/null +++ b/layout/svg/crashtests/386475-1.xhtml @@ -0,0 +1,24 @@ +<html xmlns="http://www.w3.org/1999/xhtml" + xmlns:svg="http://www.w3.org/2000/svg"> +<head> +<script> +function boom() +{ + document.body.style.display = "table-header-group"; + document.getElementById("svg").setAttribute('height', 1); +} +</script> +</head> + +<body onload="boom();"> + +<svg:svg width="100%" height="100%" id="svg"> + <svg:g> + <svg:foreignObject width="8205em" height="100%"> + <span>hello</span> <span>world</span> + </svg:foreignObject> + </svg:g> +</svg:svg> + +</body> +</html> diff --git a/layout/svg/crashtests/386690-1.svg b/layout/svg/crashtests/386690-1.svg new file mode 100644 index 0000000000..e206978134 --- /dev/null +++ b/layout/svg/crashtests/386690-1.svg @@ -0,0 +1,3 @@ +<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 30 40"> + <foreignObject width="-2" height="100" /> +</svg>
\ No newline at end of file diff --git a/layout/svg/crashtests/387290-1.svg b/layout/svg/crashtests/387290-1.svg new file mode 100644 index 0000000000..4ac8463204 --- /dev/null +++ b/layout/svg/crashtests/387290-1.svg @@ -0,0 +1,26 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!-- This Source Code Form is subject to the terms of the Mozilla Public + - License, v. 2.0. If a copy of the MPL was not distributed with this + - file, You can obtain one at http://mozilla.org/MPL/2.0/. --> +<!-- +Copyright Georgi Guninski +--> + +<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" +"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"> + +<svg version="1.1" +xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" +> +<defs> +<filter id="dafilter" filterUnits="userSpaceOnUse" +x="0" y="0" width="4194305" height="17"> +<feGaussianBlur in="SourceAlpha" stdDeviation="4" result="blur"/> +</filter> +</defs> +<g> + +<rect fill="red" width="256" height="256" filter="url(#dafilter)" transform="scale(262145,9)" /> +</g> + +</svg> diff --git a/layout/svg/crashtests/402408-1.svg b/layout/svg/crashtests/402408-1.svg new file mode 100644 index 0000000000..f442b2171e --- /dev/null +++ b/layout/svg/crashtests/402408-1.svg @@ -0,0 +1,32 @@ +<svg xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink" + onload="boom();" + class="reftest-wait"> + +<script> + +function boom() +{ + var grad1 = document.getElementById("grad1"); + var grad2 = document.getElementById("grad2"); + + grad1.appendChild(grad2); + + setTimeout(function() { + grad1.removeChild(grad2); + document.documentElement.removeAttribute("class"); + }, 30); +} + +</script> + +<linearGradient id="grad1" gradientUnits="objectBoundingBox" x1="0" y1="0" x2="1" y2="0"> + <stop id="green" stop-color="#00dd00" offset="0"/> + <stop id="blue" stop-color="#0000dd" offset="1"/> +</linearGradient> + +<linearGradient id="grad2" xlink:href="#grad1"/> + +<rect x="20" y="20" width="440" height="80" fill="url(#grad2)" /> + +</svg> diff --git a/layout/svg/crashtests/404677-1.xhtml b/layout/svg/crashtests/404677-1.xhtml new file mode 100644 index 0000000000..c1df3869b9 --- /dev/null +++ b/layout/svg/crashtests/404677-1.xhtml @@ -0,0 +1,9 @@ +<html xmlns="http://www.w3.org/1999/xhtml" xmlns:svg="http://www.w3.org/2000/svg"> +<head> +</head> +<body> + +<svg:svg height="-2" width="5" /> + +</body> +</html> diff --git a/layout/svg/crashtests/409565-1.xhtml b/layout/svg/crashtests/409565-1.xhtml new file mode 100644 index 0000000000..2c427ccc8b --- /dev/null +++ b/layout/svg/crashtests/409565-1.xhtml @@ -0,0 +1,3 @@ +<html xmlns="http://www.w3.org/1999/xhtml" style="white-space: pre;"><body style="width: 24px; height: 24px; column-width: 200px;"> + + <svg xmlns="http://www.w3.org/2000/svg" style="float: left;"></svg></body></html> diff --git a/layout/svg/crashtests/420697-1.svg b/layout/svg/crashtests/420697-1.svg new file mode 100644 index 0000000000..d8b7f38340 --- /dev/null +++ b/layout/svg/crashtests/420697-1.svg @@ -0,0 +1,7 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <text stroke="black" y="1em" + stroke-dashoffset="1%" + stroke-dasharray="1px"> + m + </text> +</svg> diff --git a/layout/svg/crashtests/420697-2.svg b/layout/svg/crashtests/420697-2.svg new file mode 100644 index 0000000000..8987693e50 --- /dev/null +++ b/layout/svg/crashtests/420697-2.svg @@ -0,0 +1,6 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <text stroke="black" y="1em" + stroke-dasharray="1%"> + m + </text> +</svg> diff --git a/layout/svg/crashtests/429774-1.svg b/layout/svg/crashtests/429774-1.svg new file mode 100644 index 0000000000..00b726de6a --- /dev/null +++ b/layout/svg/crashtests/429774-1.svg @@ -0,0 +1,29 @@ +<?xml version="1.0"?> + +<svg width="7.5cm" height="5cm" viewBox="0 0 200 120" + xmlns="http://www.w3.org/2000/svg"> + + <defs> + <filter id="MyFilter" filterUnits="userSpaceOnUse" x="0" y="0" width="200" height="120"> + + <feOffset in="SourceAlpha" result="offset" dx="4" dy="4" y="76"/> + + <feSpecularLighting in="offset" result="specOut" + surfaceScale="5" specularConstant=".75" specularExponent="20"> + <fePointLight x="-5000" y="-10000" z="20000"/> + </feSpecularLighting> + + <feComposite in="SourceAlpha" in2="SourceAlpha" result="litPaint" + operator="arithmetic" k1="0" k2="1" k3="1" k4="0"/> + + <feMerge> + <feMergeNode in="offset"/> + <feMergeNode in="litPaint"/> + </feMerge> + + </filter> + </defs> + + <g filter="url(#MyFilter)"/> + +</svg> diff --git a/layout/svg/crashtests/441368-1.svg b/layout/svg/crashtests/441368-1.svg new file mode 100644 index 0000000000..d0fee7478b --- /dev/null +++ b/layout/svg/crashtests/441368-1.svg @@ -0,0 +1,31 @@ +<?xml version="1.0" standalone="no"?> +<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" +"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"> +<!-- This Source Code Form is subject to the terms of the Mozilla Public + - License, v. 2.0. If a copy of the MPL was not distributed with this + - file, You can obtain one at http://mozilla.org/MPL/2.0/. --> +<!-- +Copyright Georgi Guninski +--> + + +<svg width="100%" height="100%" version="1.1" +xmlns="http://www.w3.org/2000/svg"> + +<defs> +<filter id="MyFilter" filterUnits="userSpaceOnUse" +x="0" y="0" width="32769" height="32769"> + +<feGaussianBlur in="SourceAlpha" stdDeviation="2147483648" result="blur"/> + +</filter> +</defs> + +<rect x="1" y="1" width="198" height="118" fill="#cccccc" /> + +<g filter="url(#MyFilter)"> +<text fill="#FFFFFF" stroke="black" font-size="45" +x="42" y="42">Feck b1ll</text> +</g> + +</svg> diff --git a/layout/svg/crashtests/453754-1.svg b/layout/svg/crashtests/453754-1.svg new file mode 100644 index 0000000000..a32d819281 --- /dev/null +++ b/layout/svg/crashtests/453754-1.svg @@ -0,0 +1,7 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + + <filter id="f" height="-1"/> + + <rect filter="url(#f)" /> + +</svg> diff --git a/layout/svg/crashtests/455314-1.xhtml b/layout/svg/crashtests/455314-1.xhtml new file mode 100644 index 0000000000..01bb33d653 --- /dev/null +++ b/layout/svg/crashtests/455314-1.xhtml @@ -0,0 +1,16 @@ +<html xmlns="http://www.w3.org/1999/xhtml"><head>
+<script>
+function doe() {
+document.getElementById('a').appendChild(document.body);
+}
+setTimeout(doe, 100);
+</script>
+</head>
+<body>
+<div style="position: absolute; -moz-appearance: button; filter: url(#b); "></div>
+<pre style="position: absolute;">
+<table id="b"></table>
+</pre>
+</body>
+<div id="a"/>
+</html>
\ No newline at end of file diff --git a/layout/svg/crashtests/458453.html b/layout/svg/crashtests/458453.html new file mode 100644 index 0000000000..ab72d46dee --- /dev/null +++ b/layout/svg/crashtests/458453.html @@ -0,0 +1,24 @@ +<html class="reftest-wait"> +<head> +<script type="text/javascript"> + +var i = 0; + +function bouncy() +{ + var body = document.body; + document.documentElement.removeChild(body); + document.documentElement.appendChild(body); + + if (++i < 30) + setTimeout(bouncy, 1); + else + document.documentElement.removeAttribute("class"); +} + +</script> +</head> + +<body onload="bouncy();"><span id="a"></span><span style="filter: url(#a);"><span style="filter: url(#a);">B</span></span></body> + +</html> diff --git a/layout/svg/crashtests/459666-1.html b/layout/svg/crashtests/459666-1.html new file mode 100644 index 0000000000..69074b6028 --- /dev/null +++ b/layout/svg/crashtests/459666-1.html @@ -0,0 +1,7 @@ +<!DOCTYPE html> +<html style="filter: url(#e);"> +<head></head> +<body onload="document.documentElement.style.counterReset = 'a';"> +<div id="e"></div> +</body> +</html> diff --git a/layout/svg/crashtests/459883.xhtml b/layout/svg/crashtests/459883.xhtml new file mode 100644 index 0000000000..e125e71d8a --- /dev/null +++ b/layout/svg/crashtests/459883.xhtml @@ -0,0 +1,13 @@ +<html xmlns="http://www.w3.org/1999/xhtml" style="filter: url(#r);" class="reftest-wait"><head> +<script type="text/javascript"> + +function boom() +{ + document.getElementById("s").setAttribute("style", "display: -moz-box;"); + document.documentElement.removeAttribute("class"); +} + +window.addEventListener("load", function() { setTimeout(boom, 0); }, false); + +</script> +</head><body><ms xmlns="http://www.w3.org/1998/Math/MathML" id="s"><maction id="r"/></ms></body></html> diff --git a/layout/svg/crashtests/461289-1.svg b/layout/svg/crashtests/461289-1.svg new file mode 100644 index 0000000000..82a57f81b0 --- /dev/null +++ b/layout/svg/crashtests/461289-1.svg @@ -0,0 +1,18 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> + +<script type="text/javascript"> + +function boom() +{ + var f = document.getElementById("filter1"); + f.appendChild(document.createElementNS("http://www.w3.org/2000/svg", "feImage")); + f.appendChild(document.getElementById("rect")); +} + +window.addEventListener("load", boom, false); + +</script> + +<filter id="filter1"/><rect id="rect" filter="url(#filter1)"/> + +</svg> diff --git a/layout/svg/crashtests/464374-1.svg b/layout/svg/crashtests/464374-1.svg new file mode 100644 index 0000000000..9844e5187f --- /dev/null +++ b/layout/svg/crashtests/464374-1.svg @@ -0,0 +1,15 @@ +<svg xmlns="http://www.w3.org/2000/svg" onload="boom();">
+
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("b").appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", "math"));
+ document.getElementById("defs").setAttribute("filter", "url(#a)");
+}
+
+</script>
+
+<defs id="defs"><filter id="a"/><g id="b"><rect/></g></defs>
+
+</svg>
diff --git a/layout/svg/crashtests/466585-1.svg b/layout/svg/crashtests/466585-1.svg new file mode 100644 index 0000000000..22ad862e15 --- /dev/null +++ b/layout/svg/crashtests/466585-1.svg @@ -0,0 +1,17 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<script type="text/javascript"> + +window.addEventListener("load", boom, false); + +function boom() +{ + document.getElementById("rect").setAttribute("filter", "url(#filter)"); + document.getElementById("defs").setAttribute("fill", "red"); +} + +</script> + +<defs id="defs"><filter id="filter"/><rect id="rect"/></defs> + +</svg> diff --git a/layout/svg/crashtests/467323-1.svg b/layout/svg/crashtests/467323-1.svg new file mode 100644 index 0000000000..9d757c349d --- /dev/null +++ b/layout/svg/crashtests/467323-1.svg @@ -0,0 +1,10 @@ +<svg xmlns="http://www.w3.org/2000/svg" width="500" height="500"> + +<filter id="f1" filterUnits="userSpaceOnUse" primitiveUnits="userSpaceOnUse"> + <feFlood flood-color="#ff0000" result="flood" x="0" y="0" width="100" height="100"/> + <feDisplacementMap style="color-interpolation-filters:sRGB" + in="SourceGraphic" in2="flood" scale="100" xChannelSelector="R" yChannelSelector="G"/> +</filter> +<g filter="url(#f1)"></g> + +</svg> diff --git a/layout/svg/crashtests/467498-1.svg b/layout/svg/crashtests/467498-1.svg new file mode 100644 index 0000000000..9839e6c30d --- /dev/null +++ b/layout/svg/crashtests/467498-1.svg @@ -0,0 +1,12 @@ +<!-- + Any copyright is dedicated to the Public Domain. + http://creativecommons.org/licenses/publicdomain/ +--> +<svg width="100%" height="100%" xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink"> + <use id="a" width="100" height="100" xlink:href="#b"/> + <use id="b" x="100" y="100" width="100" height="100" xlink:href="#a"/> + <script> + document.getElementById("a").setAttribute("width", "200"); + </script> +</svg> diff --git a/layout/svg/crashtests/470124-1.svg b/layout/svg/crashtests/470124-1.svg new file mode 100644 index 0000000000..ba3b8aff40 --- /dev/null +++ b/layout/svg/crashtests/470124-1.svg @@ -0,0 +1,7 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<filter id="f7" filterUnits="userSpaceOnUse" primitiveUnits="objectBoundingBox"><feComposite/></filter> + +<g filter="url(#f7)"/> + +</svg> diff --git a/layout/svg/crashtests/472782-1.svg b/layout/svg/crashtests/472782-1.svg new file mode 100644 index 0000000000..7cfeb11a69 --- /dev/null +++ b/layout/svg/crashtests/472782-1.svg @@ -0,0 +1,3 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="r"> +<text><textPath xlink:href="#r">S</textPath> </text> +</svg> diff --git a/layout/svg/crashtests/474700-1.svg b/layout/svg/crashtests/474700-1.svg new file mode 100644 index 0000000000..141a1b3903 --- /dev/null +++ b/layout/svg/crashtests/474700-1.svg @@ -0,0 +1 @@ +<svg xmlns="http://www.w3.org/2000/svg"><filter id="f1" height="-2"/><rect width="50" height="100" filter="url(#f1)"/></svg> diff --git a/layout/svg/crashtests/475181-1.svg b/layout/svg/crashtests/475181-1.svg new file mode 100644 index 0000000000..ef5a638afb --- /dev/null +++ b/layout/svg/crashtests/475181-1.svg @@ -0,0 +1 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><filter id="filter1"><feImage y="4095"/><feTile/></filter><rect width="100%" height="100%" filter="url(#filter1)"/></svg> diff --git a/layout/svg/crashtests/475193-1.html b/layout/svg/crashtests/475193-1.html new file mode 100644 index 0000000000..edc08bcee4 --- /dev/null +++ b/layout/svg/crashtests/475193-1.html @@ -0,0 +1,21 @@ +<!DOCTYPE HTML> +<html><head> +<meta http-equiv="content-type" content="text/html; charset=UTF-8"> + + +<style type="text/css"> + +.p { marker: url('#c'); } + +</style> +<script type="text/javascript"> + +function boom() +{ + document.getElementById("a").setAttribute("class", "p"); + document.documentElement.offsetHeight; + document.getElementById("b").setAttribute("id", "c"); +} + +</script> +</head><body onload="boom();"><div class="p" id="a">C</div><div id="c"></div></body></html>
\ No newline at end of file diff --git a/layout/svg/crashtests/475302-1.svg b/layout/svg/crashtests/475302-1.svg new file mode 100644 index 0000000000..4fdaa2213c --- /dev/null +++ b/layout/svg/crashtests/475302-1.svg @@ -0,0 +1,11 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<style type="text/css"> + tref { filter: url(#filter1); } +</style> + +<filter id="filter1"><feFlood/></filter> + +<tref><polyline points="350,75 379,161 469,161 397,215 423,301 350,250 277,301 303,215 231,161 321,161"/></tref> + +</svg> diff --git a/layout/svg/crashtests/477935-1.html b/layout/svg/crashtests/477935-1.html new file mode 100644 index 0000000000..9c2ac5438a --- /dev/null +++ b/layout/svg/crashtests/477935-1.html @@ -0,0 +1,11 @@ +<!DOCTYPE html> +<html> +<head> +<style type="text/css"> :root { filter: url('#g'); } </style> +<style type="text/css" id="ccs"> .cc { content: 'X'; } </style> +</head> +<body onload="document.getElementById('ccs').disabled = true;"> +<div id="g"></div> +<div class="cc">5</div> +</body> +</html> diff --git a/layout/svg/crashtests/478128-1.svg b/layout/svg/crashtests/478128-1.svg new file mode 100644 index 0000000000..a34552776a --- /dev/null +++ b/layout/svg/crashtests/478128-1.svg @@ -0,0 +1,15 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <script type="text/javascript"> + + function boom() + { + document.documentElement.style.columnCount = '15'; + } + window.onload = function() { setTimeout(boom, 20); }; + + </script> + + <foreignObject width="50" height="50" filter="url(#f1)"/> + + <filter id="f1"/> +</svg> diff --git a/layout/svg/crashtests/478511-1.svg b/layout/svg/crashtests/478511-1.svg new file mode 100644 index 0000000000..75a4aaa9b2 --- /dev/null +++ b/layout/svg/crashtests/478511-1.svg @@ -0,0 +1,9 @@ +<svg xmlns="http://www.w3.org/2000/svg" version="1.0"> + <defs> + <pattern id="pattern" + x="0" y="0" width="200" height="200"> + <circle fill="lime" r="100" cx="100" cy="100"/> + </pattern> + </defs> + <rect width="200" height="200" fill="url(#pattern)"/> +</svg> diff --git a/layout/svg/crashtests/483439-1.svg b/layout/svg/crashtests/483439-1.svg new file mode 100644 index 0000000000..c9e9ebae1c --- /dev/null +++ b/layout/svg/crashtests/483439-1.svg @@ -0,0 +1,17 @@ +<svg xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink"> + + <defs> + <path id="myTextPath" + d="M275,20 + a1,1 0 0,0 100,0 + " + /> + </defs> + + <svg y="15"> + <text x="10" y="100" style="stroke: #000000;"> + <textPath xlink:href="#myTextPath" >Text along a curved path...</textPath> + </text> + </svg> +</svg> diff --git a/layout/svg/crashtests/492186-1.svg b/layout/svg/crashtests/492186-1.svg new file mode 100644 index 0000000000..7f4b6650ab --- /dev/null +++ b/layout/svg/crashtests/492186-1.svg @@ -0,0 +1,6 @@ +<svg xmlns="http://www.w3.org/2000/svg"> +<altGlyphDef/> +<script xmlns="http://www.w3.org/1999/xhtml"> +document.documentElement.getBBox(); +</script> +</svg> diff --git a/layout/svg/crashtests/508247-1.svg b/layout/svg/crashtests/508247-1.svg new file mode 100644 index 0000000000..c8b36b905f --- /dev/null +++ b/layout/svg/crashtests/508247-1.svg @@ -0,0 +1,10 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<definition-src> +<path id="a"/> +</definition-src> + +<script id="script" xmlns="http://www.w3.org/1999/xhtml"> +setTimeout(function() {document.getElementById('a').getCTM()},10); +</script> +</svg> diff --git a/layout/svg/crashtests/512890-1.svg b/layout/svg/crashtests/512890-1.svg new file mode 100644 index 0000000000..044f693892 --- /dev/null +++ b/layout/svg/crashtests/512890-1.svg @@ -0,0 +1,4 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <filter id="f" height="1em"/> + <rect width="50" height="50" filter="url(#f)"/> +</svg> diff --git a/layout/svg/crashtests/515288-1.html b/layout/svg/crashtests/515288-1.html new file mode 100644 index 0000000000..d78cbbfbec --- /dev/null +++ b/layout/svg/crashtests/515288-1.html @@ -0,0 +1,5 @@ +<script> +var svgElem = document.createElementNS("http://www.w3.org/2000/svg", "svg"); +document.createElement("script").appendChild(svgElem); +svgElem.getScreenCTM(); +</script>
\ No newline at end of file diff --git a/layout/svg/crashtests/522394-1.svg b/layout/svg/crashtests/522394-1.svg new file mode 100644 index 0000000000..f745c47dd2 --- /dev/null +++ b/layout/svg/crashtests/522394-1.svg @@ -0,0 +1,12 @@ +<!-- + Any copyright is dedicated to the Public Domain. + http://creativecommons.org/licenses/publicdomain/ +--> +<svg xmlns="http://www.w3.org/2000/svg"> +<defs> + <filter id="f1" x="0" y="0" width="-100" height="-100" filterUnits="userSpaceOnUse" primitiveUnits="userSpaceOnUse"> + <feFlood flood-color="lime" x="0" y="0" width="100%" height="100%"/> + </filter> +</defs> +<rect x="10" y="10" width="10" height="10" filter="url(#f1)"/> +</svg> diff --git a/layout/svg/crashtests/522394-2.svg b/layout/svg/crashtests/522394-2.svg new file mode 100644 index 0000000000..1b6f1f0892 --- /dev/null +++ b/layout/svg/crashtests/522394-2.svg @@ -0,0 +1,12 @@ +<!-- + Any copyright is dedicated to the Public Domain. + http://creativecommons.org/licenses/publicdomain/ +--> +<svg xmlns="http://www.w3.org/2000/svg"> +<defs> + <filter id="f1" x="0" y="0" width="100000000" height="100000000" filterUnits="userSpaceOnUse" primitiveUnits="userSpaceOnUse"> + <feFlood flood-color="lime" x="0" y="0" width="100%" height="100%"/> + </filter> +</defs> +<rect x="10" y="10" width="10" height="10" filter="url(#f1)"/> +</svg> diff --git a/layout/svg/crashtests/522394-3.svg b/layout/svg/crashtests/522394-3.svg new file mode 100644 index 0000000000..cf3483cfad --- /dev/null +++ b/layout/svg/crashtests/522394-3.svg @@ -0,0 +1,12 @@ +<!-- + Any copyright is dedicated to the Public Domain. + http://creativecommons.org/licenses/publicdomain/ +--> +<svg xmlns="http://www.w3.org/2000/svg"> +<defs> + <filter id="f1" x="0" y="0" width="4563402752" height="4563402752" filterUnits="userSpaceOnUse" primitiveUnits="userSpaceOnUse"> + <feFlood flood-color="lime" x="0" y="0" width="100%" height="100%"/> + </filter> +</defs> +<rect x="10" y="10" width="10" height="10" filter="url(#f1)"/> +</svg> diff --git a/layout/svg/crashtests/566216-1.svg b/layout/svg/crashtests/566216-1.svg new file mode 100644 index 0000000000..999aaf4f08 --- /dev/null +++ b/layout/svg/crashtests/566216-1.svg @@ -0,0 +1,19 @@ +<?xml version="1.0"?> + +<svg xmlns="http://www.w3.org/2000/svg"><animate id="y"/><script> +<![CDATA[ + +function boom() +{ + var r = document.createRange(); + r.setEnd(document.getElementById('y'), 0); + r.extractContents(); +} + +window.addEventListener("load", boom, false); + +]]> +</script> +</svg> + + diff --git a/layout/svg/crashtests/587336-1.html b/layout/svg/crashtests/587336-1.html new file mode 100644 index 0000000000..811f483dd7 --- /dev/null +++ b/layout/svg/crashtests/587336-1.html @@ -0,0 +1,9 @@ +<html> +<head><script> +function boom() +{ + var b = document.getElementById("b"); + b.setAttributeNS(null, "style", "filter: url(#a);"); +} +</script></head> +<body onload="boom();" id="a"><span id="b">B</span></body></html> diff --git a/layout/svg/crashtests/590291-1.svg b/layout/svg/crashtests/590291-1.svg new file mode 100644 index 0000000000..db26fac3a8 --- /dev/null +++ b/layout/svg/crashtests/590291-1.svg @@ -0,0 +1,9 @@ +<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" version="1.1" width="0cm" height="0cm">
+
+<text id="a">a</text>
+
+<script><![CDATA[
+var x=document.getElementById('a').getExtentOfChar(0);
+]]></script>
+</svg>
diff --git a/layout/svg/crashtests/601999-1.html b/layout/svg/crashtests/601999-1.html new file mode 100644 index 0000000000..7e8a3d39de --- /dev/null +++ b/layout/svg/crashtests/601999-1.html @@ -0,0 +1,5 @@ +<html class="reftest-wait"> + <body onload="document.getElementsByTagName('div')[0].id='b'; + document.documentElement.removeAttribute('class');" + ><div style="overflow-x: scroll; filter: url(#b)">abc</div></body> +</html> diff --git a/layout/svg/crashtests/605626-1.svg b/layout/svg/crashtests/605626-1.svg new file mode 100644 index 0000000000..678b011797 --- /dev/null +++ b/layout/svg/crashtests/605626-1.svg @@ -0,0 +1,3 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> +<image width="10" height="10" xlink:href="data:text/plain,g"/> +</svg> diff --git a/layout/svg/crashtests/606914.xhtml b/layout/svg/crashtests/606914.xhtml new file mode 100644 index 0000000000..fc019af573 --- /dev/null +++ b/layout/svg/crashtests/606914.xhtml @@ -0,0 +1 @@ +<html xmlns="http://www.w3.org/1999/xhtml" style="display: table; position: absolute; left: 2305843009213694000pc; bottom: 2452284pc; padding: 9931442138140%; border-bottom-right-radius: 1152921504606847000pc;">X</html> diff --git a/layout/svg/crashtests/610594-1.html b/layout/svg/crashtests/610594-1.html new file mode 100644 index 0000000000..ee48e762cc --- /dev/null +++ b/layout/svg/crashtests/610594-1.html @@ -0,0 +1,6 @@ +<!DOCTYPE html> +<html> +<body> +<svg><path d="M 0 5 a 2 5 -30 104 -5" marker-mid="url(#q)"></path></svg> +</body> +</html> diff --git a/layout/svg/crashtests/610954-1.html b/layout/svg/crashtests/610954-1.html new file mode 100644 index 0000000000..f5080df8b8 --- /dev/null +++ b/layout/svg/crashtests/610954-1.html @@ -0,0 +1 @@ +<!DOCTYPE html><html><body dir=rtl onload="document.getElementById('g').style.filter = 'url(#filter1)';"><span id="g">‎---</span></body></html> diff --git a/layout/svg/crashtests/612662-1.svg b/layout/svg/crashtests/612662-1.svg new file mode 100644 index 0000000000..73dc98ed19 --- /dev/null +++ b/layout/svg/crashtests/612662-1.svg @@ -0,0 +1 @@ +<svg xmlns="http://www.w3.org/2000/svg" style="background: url(#a); direction: rtl; margin: -32944px;"></svg> diff --git a/layout/svg/crashtests/612662-2.svg b/layout/svg/crashtests/612662-2.svg new file mode 100644 index 0000000000..b46841132f --- /dev/null +++ b/layout/svg/crashtests/612662-2.svg @@ -0,0 +1,3 @@ +<svg xmlns="http://www.w3.org/2000/svg" + style="direction: rtl; margin: -32944px; + background: url(data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3C%2Fsvg%3E)"></svg> diff --git a/layout/svg/crashtests/612736-1.svg b/layout/svg/crashtests/612736-1.svg new file mode 100644 index 0000000000..cb3044efd0 --- /dev/null +++ b/layout/svg/crashtests/612736-1.svg @@ -0,0 +1,19 @@ +<svg xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink" + class="reftest-wait"> + <path id="path"/> + <text> + <textPath xlink:href="#path">f</textPath> + <textPath xlink:href="#path">f</textPath> + </text> + + <script> + function boom() + { + var path = document.getElementById("path"); + path.parentNode.removeChild(path); + document.documentElement.removeAttribute("class"); + } + window.addEventListener("load", boom, false); + </script> +</svg> diff --git a/layout/svg/crashtests/612736-2.svg b/layout/svg/crashtests/612736-2.svg new file mode 100644 index 0000000000..30b8245a9f --- /dev/null +++ b/layout/svg/crashtests/612736-2.svg @@ -0,0 +1,8 @@ +<svg xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink"> + <path id="path" d="M0 100 h50" stroke="black"/> + <text> + <textPath xlink:href="#path">abc</textPath> + <textPath xlink:href="#path">def</textPath> + </text> +</svg> diff --git a/layout/svg/crashtests/614367-1.svg b/layout/svg/crashtests/614367-1.svg new file mode 100644 index 0000000000..3af7b491da --- /dev/null +++ b/layout/svg/crashtests/614367-1.svg @@ -0,0 +1,8 @@ +<?xml version="1.0"?> + +<svg xmlns="http://www.w3.org/2000/svg"> + <polygon id="p" transform="?" /> + <script> + document.getElementById("p").transform.baseVal.removeItem(0); + </script> +</svg> diff --git a/layout/svg/crashtests/620034-1.html b/layout/svg/crashtests/620034-1.html new file mode 100644 index 0000000000..bfffd3ffac --- /dev/null +++ b/layout/svg/crashtests/620034-1.html @@ -0,0 +1,15 @@ +<!DOCTYPE html> +<script> + +function boom() +{ + var f = document.createElementNS("http://www.w3.org/2000/svg", "feFuncB"); + var tvb = f.tableValues.baseVal; + f.setAttribute("tableValues", "3 7 5"); + f.setAttribute("tableValues", "i"); + tvb.numberOfItems; +} + +boom(); + +</script> diff --git a/layout/svg/crashtests/621598-1.svg b/layout/svg/crashtests/621598-1.svg new file mode 100644 index 0000000000..dd47967d35 --- /dev/null +++ b/layout/svg/crashtests/621598-1.svg @@ -0,0 +1,16 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <marker id="m1"> + <rect/> + <marker> + <line id="z" marker-end="url(#m1)"/> + </marker> + </marker> + <script> + function boom() + { + document.getElementById("z").getBoundingClientRect(); + } + window.addEventListener("load", boom, false); + </script> + +</svg> diff --git a/layout/svg/crashtests/648819-1.html b/layout/svg/crashtests/648819-1.html new file mode 100644 index 0000000000..727ca3e55f --- /dev/null +++ b/layout/svg/crashtests/648819-1.html @@ -0,0 +1,6 @@ +<!DOCTYPE html> +<script> +var p = document.createElementNS("http://www.w3.org/2000/svg", "pattern"); +p.setAttribute("patternTransform", "i"); +p.patternTransform.baseVal.clear(); +</script> diff --git a/layout/svg/crashtests/655025-1.svg b/layout/svg/crashtests/655025-1.svg new file mode 100644 index 0000000000..4501bb57fa --- /dev/null +++ b/layout/svg/crashtests/655025-1.svg @@ -0,0 +1,6 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <text id="a">a</text> + <script> + document.getElementById("a").firstChild.nodeValue = ""; + </script> +</svg> diff --git a/layout/svg/crashtests/655025-2.svg b/layout/svg/crashtests/655025-2.svg new file mode 100644 index 0000000000..601006e831 --- /dev/null +++ b/layout/svg/crashtests/655025-2.svg @@ -0,0 +1,6 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <text id="a">a</text> + <script> + document.getElementById("a").appendChild(document.createTextNode("")); + </script> +</svg> diff --git a/layout/svg/crashtests/655025-3.svg b/layout/svg/crashtests/655025-3.svg new file mode 100644 index 0000000000..43e06b6fc3 --- /dev/null +++ b/layout/svg/crashtests/655025-3.svg @@ -0,0 +1,9 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <script> + var a = document.createElementNS("http://www.w3.org/2000/svg", "text"); + a.appendChild(document.createTextNode("")); + document.documentElement.appendChild(a); + a.getNumberOfChars(); + document.documentElement.removeChild(a); + </script> +</svg> diff --git a/layout/svg/crashtests/657077-1.svg b/layout/svg/crashtests/657077-1.svg new file mode 100644 index 0000000000..b0165bd14a --- /dev/null +++ b/layout/svg/crashtests/657077-1.svg @@ -0,0 +1,19 @@ +<?xml version="1.0" encoding="Windows-1252"?> +<svg xmlns="http://www.w3.org/2000/svg"> + +<svg id="a" requiredExtensions="x"/> + +<script> +<![CDATA[ + +function boom() +{ + document.getElementById("a").unsuspendRedrawAll(); +} + +window.addEventListener("load", boom, false); + +]]> +</script> + +</svg> diff --git a/layout/svg/crashtests/669025-1.svg b/layout/svg/crashtests/669025-1.svg new file mode 100644 index 0000000000..eb529da4e0 --- /dev/null +++ b/layout/svg/crashtests/669025-1.svg @@ -0,0 +1,8 @@ +<?xml version="1.0"?> +<svg xmlns="http://www.w3.org/2000/svg"> + <script type="text/javascript"> + + document.createElementNS("http://www.w3.org/2000/svg", "filter").filterResX; + + </script> +</svg> diff --git a/layout/svg/crashtests/669025-2.svg b/layout/svg/crashtests/669025-2.svg new file mode 100644 index 0000000000..ccecebef3c --- /dev/null +++ b/layout/svg/crashtests/669025-2.svg @@ -0,0 +1,8 @@ +<?xml version="1.0"?> +<svg xmlns="http://www.w3.org/2000/svg"> + <script type="text/javascript"> + + document.createElementNS("http://www.w3.org/2000/svg", "feGaussianBlur").stdDeviationX; + + </script> +</svg> diff --git a/layout/svg/crashtests/682411-1.svg b/layout/svg/crashtests/682411-1.svg new file mode 100644 index 0000000000..92d0c0a725 --- /dev/null +++ b/layout/svg/crashtests/682411-1.svg @@ -0,0 +1,5 @@ +<?xml version="1.0" encoding="Windows-1252"?> +<svg xmlns="http://www.w3.org/2000/svg" style="width: 0pt; padding: 100px;"> + <filter id="s"/> + <g filter="url(#s)"><text>z</text></g> +</svg> diff --git a/layout/svg/crashtests/692203-1.svg b/layout/svg/crashtests/692203-1.svg new file mode 100644 index 0000000000..8427b84268 --- /dev/null +++ b/layout/svg/crashtests/692203-1.svg @@ -0,0 +1,4 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <marker id="marker" markerWidth="0"/> + <path d="M0,0 L100,100 200,200" marker-mid="url(#marker)"/> +</svg> diff --git a/layout/svg/crashtests/692203-2.svg b/layout/svg/crashtests/692203-2.svg new file mode 100644 index 0000000000..b59926dbba --- /dev/null +++ b/layout/svg/crashtests/692203-2.svg @@ -0,0 +1,4 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <marker id="marker" markerHeight="0"/> + <path d="M0,0 L100,100 200,200" marker-mid="url(#marker)"/> +</svg> diff --git a/layout/svg/crashtests/693424-1.svg b/layout/svg/crashtests/693424-1.svg new file mode 100644 index 0000000000..8485f6b617 --- /dev/null +++ b/layout/svg/crashtests/693424-1.svg @@ -0,0 +1,6 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <marker id="m"> + <foreignObject/> + </marker> + <line marker-end="url(#m)"/> +</svg> diff --git a/layout/svg/crashtests/709920-1.svg b/layout/svg/crashtests/709920-1.svg new file mode 100644 index 0000000000..5f25155307 --- /dev/null +++ b/layout/svg/crashtests/709920-1.svg @@ -0,0 +1,23 @@ +<svg xmlns="http://www.w3.org/2000/svg" + class="reftest-wait"> + <!-- Test to be sure that a zero-sized-in-one-dimension viewBox doesn't + make us fail assertions. --> + <script> + document.addEventListener("MozReftestInvalidate", waitAndFinish, false); + + function waitAndFinish() { + // Sadly, MozReftestInvalidate fires sooner than PaintPattern here, so + // we need to wait a little bit to give PaintPattern a chance to hit + // this bug. + setTimeout(finish, 100); + } + + function finish() { + document.documentElement.removeAttribute("class"); + } + </script> + <pattern id="test" viewBox="0 0 1 0"> + <rect/> + </pattern> + <rect width="200" height="200" fill="url(#test)"/> +</svg> diff --git a/layout/svg/crashtests/709920-2.svg b/layout/svg/crashtests/709920-2.svg new file mode 100644 index 0000000000..58c51111eb --- /dev/null +++ b/layout/svg/crashtests/709920-2.svg @@ -0,0 +1,23 @@ +<svg xmlns="http://www.w3.org/2000/svg" + class="reftest-wait"> + <!-- Test to be sure that a zero-sized-in-one-dimension viewBox doesn't + make us fail assertions. --> + <script> + document.addEventListener("MozReftestInvalidate", waitAndFinish, false); + + function waitAndFinish() { + // Sadly, MozReftestInvalidate fires sooner than PaintPattern here, so + // we need to wait a little bit to give PaintPattern a chance to hit + // this bug. + setTimeout(finish, 100); + } + + function finish() { + document.documentElement.removeAttribute("class"); + } + </script> + <pattern id="test" viewBox="0 0 0 1"> + <rect/> + </pattern> + <rect width="200" height="200" fill="url(#test)"/> +</svg> diff --git a/layout/svg/crashtests/713413-1.svg b/layout/svg/crashtests/713413-1.svg new file mode 100644 index 0000000000..7131202335 --- /dev/null +++ b/layout/svg/crashtests/713413-1.svg @@ -0,0 +1,12 @@ +<?xml version="1.0" encoding="Windows-1252"?> +<svg xmlns="http://www.w3.org/2000/svg"> + +<marker id="m"></marker> + +<script> +window.addEventListener("load", function() { + document.getElementById("m").appendChild(document.createElementNS("http://www.w3.org/2000/svg", "foreignObject")); +}, false); +</script> + +</svg> diff --git a/layout/svg/crashtests/722003-1.svg b/layout/svg/crashtests/722003-1.svg new file mode 100644 index 0000000000..58e2d57734 --- /dev/null +++ b/layout/svg/crashtests/722003-1.svg @@ -0,0 +1,13 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<marker><foreignObject><span id="x" xmlns="http://www.w3.org/1999/xhtml"></span></foreignObject></marker> + +<script> + +window.addEventListener("load", function() { + document.getElementById("x").getClientRects(); +}, false); + +</script> + +</svg> diff --git a/layout/svg/crashtests/725918-1.svg b/layout/svg/crashtests/725918-1.svg new file mode 100644 index 0000000000..5ebdf33f69 --- /dev/null +++ b/layout/svg/crashtests/725918-1.svg @@ -0,0 +1,4 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <text stroke="url(#p)">t</text> + <pattern id="p"/> +</svg> diff --git a/layout/svg/crashtests/732836-1.svg b/layout/svg/crashtests/732836-1.svg new file mode 100644 index 0000000000..a9abb46668 --- /dev/null +++ b/layout/svg/crashtests/732836-1.svg @@ -0,0 +1,17 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" > + + <symbol id="z"> + <use xlink:href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' id='root' />#root" /> + </symbol> + + <use id="a" xlink:href="#z" width="20"/> + + <script> + window.addEventListener("load", function() { + window.scrollByPages(0); + document.getElementById("a").removeAttribute("width"); + document.elementFromPoint(0, 0); + }, false); + </script> + +</svg> diff --git a/layout/svg/crashtests/740627-1.svg b/layout/svg/crashtests/740627-1.svg new file mode 100644 index 0000000000..b74fcd2ddd --- /dev/null +++ b/layout/svg/crashtests/740627-1.svg @@ -0,0 +1,6 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <pattern id="test" viewBox="0 0 10 10" height="-65%"> + <rect/> + </pattern> + <rect width="100" height="100" fill="url(#test)"/> +</svg> diff --git a/layout/svg/crashtests/740627-2.svg b/layout/svg/crashtests/740627-2.svg new file mode 100644 index 0000000000..6241ddaae5 --- /dev/null +++ b/layout/svg/crashtests/740627-2.svg @@ -0,0 +1,6 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <pattern id="test" viewBox="0 0 10 10" width="-65%"> + <rect/> + </pattern> + <rect width="100" height="100" fill="url(#test)"/> +</svg> diff --git a/layout/svg/crashtests/743469.svg b/layout/svg/crashtests/743469.svg new file mode 100644 index 0000000000..6affc6fab8 --- /dev/null +++ b/layout/svg/crashtests/743469.svg @@ -0,0 +1,5 @@ +<svg xmlns="http://www.w3.org/2000/svg" style="border-width: 51703084143745256mm; border-left-style: dashed; border-top-left-radius: 3%; border-top-style: dashed; border-right-style: solid; border-image-outset: 10;"> +<script> +document.elementFromPoint(20, 20); +</script> +</svg> diff --git a/layout/svg/crashtests/757704-1.svg b/layout/svg/crashtests/757704-1.svg new file mode 100644 index 0000000000..b7e610e0e1 --- /dev/null +++ b/layout/svg/crashtests/757704-1.svg @@ -0,0 +1,17 @@ +<?xml version="1.0"?> + +<svg xmlns="http://www.w3.org/2000/svg"><script> +<![CDATA[ + +function boom() +{ + var rect = document.createElementNS("http://www.w3.org/2000/svg", "rect"); + document.documentElement.appendChild(rect); + document.removeChild(document.documentElement); + rect.getScreenCTM(); +} + +window.addEventListener("load", boom, false); + +]]> +</script></svg> diff --git a/layout/svg/crashtests/757718-1.svg b/layout/svg/crashtests/757718-1.svg new file mode 100644 index 0000000000..fa948c6677 --- /dev/null +++ b/layout/svg/crashtests/757718-1.svg @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var svgDoc = (new DOMParser).parseFromString("<svg xmlns='http://www.w3.org/2000/svg'></svg>", "image/svg+xml"); + var svgRoot = svgDoc.documentElement; + var rf = svgRoot.requiredFeatures; + document.adoptNode(svgRoot); + Object.getOwnPropertyNames(rf); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/layout/svg/crashtests/757751-1.svg b/layout/svg/crashtests/757751-1.svg new file mode 100644 index 0000000000..7ab51d0d19 --- /dev/null +++ b/layout/svg/crashtests/757751-1.svg @@ -0,0 +1,8 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <defs> + <svg id="x" viewBox=" 0 0 10 10"/> + </defs> + <script> + window.addEventListener("load", function() { document.getElementById("x").setAttribute("width", "2"); }, false); + </script> +</svg> diff --git a/layout/svg/crashtests/767056-1.svg b/layout/svg/crashtests/767056-1.svg new file mode 100644 index 0000000000..b813d784b3 --- /dev/null +++ b/layout/svg/crashtests/767056-1.svg @@ -0,0 +1,21 @@ +<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:xlink="http://www.w3.org/1999/xlink"
+ width="100%"
+ class="reftest-wait">
+ <script>
+
+function resize() {
+ // Set the viewBox to the same width as the content area, but slightly
+ // higher. This checks that we don't enter an infinite reflow loop. See
+ // https://bugzilla.mozilla.org/show_bug.cgi?id=767056#c10
+ var viewBox = "0 0 " + window.innerWidth + " " + (window.innerHeight + 1);
+ document.documentElement.setAttribute("viewBox", viewBox);
+ document.documentElement.removeAttribute("class");
+}
+
+document.addEventListener("MozReftestInvalidate", resize, false);
+setTimeout(resize, 3000); // For non-gecko
+
+ </script>
+ <rect width="100%" height="100%"/>
+</svg>
diff --git a/layout/svg/crashtests/767535-1.xhtml b/layout/svg/crashtests/767535-1.xhtml new file mode 100644 index 0000000000..2a923fcc6d --- /dev/null +++ b/layout/svg/crashtests/767535-1.xhtml @@ -0,0 +1,22 @@ +<html xmlns="http://www.w3.org/1999/xhtml" style="columns: 2 auto;" class="reftest-wait"> + <head> + <script> + +function test() { + var r = document.documentElement; + document.removeChild(r); + document.appendChild(r); + document.documentElement.removeAttribute("class"); +} + + </script> + </head> + <body style="filter:url(#f);" onload="setTimeout(test, 0);"> + <div> + </div> + <svg xmlns="http://www.w3.org/2000/svg"> + <filter id="f"/> + </svg> + </body> +</html> + diff --git a/layout/svg/crashtests/768087-1.html b/layout/svg/crashtests/768087-1.html new file mode 100644 index 0000000000..9a7899f9d1 --- /dev/null +++ b/layout/svg/crashtests/768087-1.html @@ -0,0 +1,4 @@ +<!DOCTYPE html> +<html> +<body onload="setTimeout(function() { document.body.innerHTML = '<span>x<svg viewbox=\'0 0 30 40\' ></svg></span>'; }, 0);"></body> +</html> diff --git a/layout/svg/crashtests/768351.svg b/layout/svg/crashtests/768351.svg new file mode 100644 index 0000000000..50a4b9b9c4 --- /dev/null +++ b/layout/svg/crashtests/768351.svg @@ -0,0 +1,2 @@ +<svg xmlns="http://www.w3.org/2000/svg" style="mask: url('data:text/plain,1#f');" /> + diff --git a/layout/svg/crashtests/772313-1.svg b/layout/svg/crashtests/772313-1.svg new file mode 100644 index 0000000000..c77af02b6e --- /dev/null +++ b/layout/svg/crashtests/772313-1.svg @@ -0,0 +1 @@ +<svg xmlns="http://www.w3.org/2000/svg" style="background: url(#d); width: 0.1px;"></svg> diff --git a/layout/svg/crashtests/778492-1.svg b/layout/svg/crashtests/778492-1.svg new file mode 100644 index 0000000000..76deda594e --- /dev/null +++ b/layout/svg/crashtests/778492-1.svg @@ -0,0 +1,4 @@ +<?xml version="1.0"?> +<svg width="1cm" viewBox="0 0 1 1" xmlns="http://www.w3.org/2000/svg"> +<line x2="100" y2="100"/> +</svg> diff --git a/layout/svg/crashtests/779971-1.svg b/layout/svg/crashtests/779971-1.svg new file mode 100644 index 0000000000..d57065a0ba --- /dev/null +++ b/layout/svg/crashtests/779971-1.svg @@ -0,0 +1,14 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="r" class="reftest-wait"> +<text id="t"><textPath xlink:href="#r">x</textPath>1</text> +<script> + +window.addEventListener("load", function() { + setTimeout(function() { + document.getElementById("t").lastChild.data = "2"; + + document.documentElement.removeAttribute("class"); + }, 200); +}, false); + +</script> +</svg> diff --git a/layout/svg/crashtests/780764-1.svg b/layout/svg/crashtests/780764-1.svg new file mode 100644 index 0000000000..6f4eb970bb --- /dev/null +++ b/layout/svg/crashtests/780764-1.svg @@ -0,0 +1,18 @@ +<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait"> + +<marker id="marker"><path d="M100,0 l100,100 200,200" filter="url(#filter)"/></marker> + +<filter id="filter"/> + +<path d="M100,0 l100,100 200,200" marker-mid="url(#marker)"/> + +<script> +window.addEventListener("load", function() { + setTimeout(function() { + document.getElementById("filter").style.fontWeight = "bold"; + document.documentElement.removeAttribute("class"); + }, 200); +}, false); +</script> + +</svg> diff --git a/layout/svg/crashtests/780963-1.html b/layout/svg/crashtests/780963-1.html new file mode 100644 index 0000000000..8cbeb1a37f --- /dev/null +++ b/layout/svg/crashtests/780963-1.html @@ -0,0 +1,27 @@ +<!DOCTYPE html> +<html> + <head> + <script> + +function tweak() { + document.body.offsetTop; + + var feImage = document.getElementsByTagName("feImage")[0]; + feImage.setAttribute('filter', 'url(#f1)') + document.body.offsetTop; + + var child = document.createElementNS('http://www.w3.org/2000/svg', 'g') + feImage.appendChild(child); +} + + </script> + </head> + <body onload="tweak()"> + <svg xmlns="http://www.w3.org/2000/svg"> + <filter filterUnits="userSpaceOnUse" id="f1"> + <feImage/> + </filter> + <rect height="100" width="100"/> + </svg> + </body> +</html> diff --git a/layout/svg/crashtests/782141-1.svg b/layout/svg/crashtests/782141-1.svg new file mode 100644 index 0000000000..6f0af76ff4 --- /dev/null +++ b/layout/svg/crashtests/782141-1.svg @@ -0,0 +1,16 @@ +<svg xmlns="http://www.w3.org/2000/svg" version="1.1" + onload="go()"> + <script> + +function go() { + var f = document.getElementById('f'); + var fm = document.getElementById('fm'); + f.appendChild(fm.cloneNode(1)); +} + + </script> + <filter id="f"> + <feMorphology id="fm" radius="2147483500"/> + </filter> + <rect height="28" width="256" filter="url(#f)" /> +</svg> diff --git a/layout/svg/crashtests/784061-1.svg b/layout/svg/crashtests/784061-1.svg new file mode 100644 index 0000000000..6a9623154d --- /dev/null +++ b/layout/svg/crashtests/784061-1.svg @@ -0,0 +1,16 @@ +<svg xmlns="http://www.w3.org/2000/svg" + class="reftest-wait"> + +<defs><path id="x"/></defs> + +<script> +function boom() +{ + document.getElementById("x").style.transform = "translate(0px)"; + document.documentElement.removeAttribute("class"); +} + +window.addEventListener("load", boom, false); +</script> + +</svg> diff --git a/layout/svg/crashtests/788831-1.svg b/layout/svg/crashtests/788831-1.svg new file mode 100644 index 0000000000..b6202a1324 --- /dev/null +++ b/layout/svg/crashtests/788831-1.svg @@ -0,0 +1,5 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> + <pattern id="pattern" width="40" height="40"><stop/></pattern> + <rect id="rect" width="200" height="100"/> + <use xlink:href="#rect" stroke="url(#pattern)" /> +</svg> diff --git a/layout/svg/crashtests/789390-1.html b/layout/svg/crashtests/789390-1.html new file mode 100644 index 0000000000..542037f229 --- /dev/null +++ b/layout/svg/crashtests/789390-1.html @@ -0,0 +1 @@ +<html style="transition: 1s;"><body onload="document.documentElement.style.stroke = '-moz-objectStroke';"></body></html> diff --git a/layout/svg/crashtests/790072.svg b/layout/svg/crashtests/790072.svg new file mode 100644 index 0000000000..b288251a7e --- /dev/null +++ b/layout/svg/crashtests/790072.svg @@ -0,0 +1 @@ +<svg xmlns="http://www.w3.org/2000/svg"><text style="stroke: -moz-objectfill none;">abc</text></svg> diff --git a/layout/svg/crashtests/791826-1.svg b/layout/svg/crashtests/791826-1.svg new file mode 100644 index 0000000000..f42261a3ad --- /dev/null +++ b/layout/svg/crashtests/791826-1.svg @@ -0,0 +1,14 @@ +<svg xmlns="http://www.w3.org/2000/svg" style="position: fixed;"> +<script> +<![CDATA[ + +function boom() +{ + document.documentElement.setAttribute("preserveAspectRatio", "_"); +} + +window.addEventListener("load", boom, false); + +]]> +</script> +</svg> diff --git a/layout/svg/crashtests/803562-1.svg b/layout/svg/crashtests/803562-1.svg new file mode 100644 index 0000000000..e6fc91127e --- /dev/null +++ b/layout/svg/crashtests/803562-1.svg @@ -0,0 +1,18 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<foreignObject width="500" height="500" style="-moz-appearance: checkbox;"> + <option xmlns="http://www.w3.org/1999/xhtml"></option> +</foreignObject> + +<script> +<![CDATA[ + +window.addEventListener("load", function() { + document.getElementsByTagName("option")[0].appendChild(document.createTextNode("Option 1")); +}, false); + +]]> +</script> + +</svg> + diff --git a/layout/svg/crashtests/808318-1.svg b/layout/svg/crashtests/808318-1.svg new file mode 100644 index 0000000000..48907225cc --- /dev/null +++ b/layout/svg/crashtests/808318-1.svg @@ -0,0 +1,2 @@ +<svg xmlns="http://www.w3.org/2000/svg" style="-moz-transform-style: preserve-3d"></svg> + diff --git a/layout/svg/crashtests/813420-1.svg b/layout/svg/crashtests/813420-1.svg new file mode 100644 index 0000000000..d977c0e982 --- /dev/null +++ b/layout/svg/crashtests/813420-1.svg @@ -0,0 +1,14 @@ +<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait"> + <svg id="i" style="mask: url("#none");"> + <marker id="markerEnd"/><polygon marker-end="url(#markerEnd)" points="250,150 200,150"/> + </svg> + <script> + +window.addEventListener("MozReftestInvalidate", function() { + document.getElementById("i").style.mask = "url(#none)"; + document.documentElement.removeAttribute("class"); +}, false); + + </script> +</svg> + diff --git a/layout/svg/crashtests/841163-1.svg b/layout/svg/crashtests/841163-1.svg new file mode 100644 index 0000000000..b1bb5198ab --- /dev/null +++ b/layout/svg/crashtests/841163-1.svg @@ -0,0 +1,29 @@ +<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait"> + +<filter id="f"/> + +<g filter="url(#f)"> + <text>AB</text> +</g> + +<script> + +function forceFrameConstruction() +{ + document.documentElement.getBoundingClientRect(); +} + +function boom() +{ + document.getElementsByTagName("text")[0].firstChild.splitText(1); + forceFrameConstruction(); + document.normalize(); + forceFrameConstruction(); + document.documentElement.removeAttribute("class"); +} + +window.addEventListener("load", boom, false); + +</script> + +</svg> diff --git a/layout/svg/crashtests/841812-1.svg b/layout/svg/crashtests/841812-1.svg new file mode 100644 index 0000000000..e5bcaa66ee --- /dev/null +++ b/layout/svg/crashtests/841812-1.svg @@ -0,0 +1,11 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> + <text> + <circle> + <textPath id="t" xlink:href="data:text/html,1" /> + </circle> + </text> + + <script> + window.addEventListener("load", function() { document.getElementById("t").removeAttribute('xlink:href'); }, false); + </script> +</svg> diff --git a/layout/svg/crashtests/842009-1.svg b/layout/svg/crashtests/842009-1.svg new file mode 100644 index 0000000000..25656ba530 --- /dev/null +++ b/layout/svg/crashtests/842009-1.svg @@ -0,0 +1,5 @@ +<svg xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink"> + <title id="hello">hello</title> + <text x="100" y="100"> <tref xlink:href="#hello"/></text> +</svg> diff --git a/layout/svg/crashtests/842630-1.svg b/layout/svg/crashtests/842630-1.svg new file mode 100644 index 0000000000..8d36998be6 --- /dev/null +++ b/layout/svg/crashtests/842630-1.svg @@ -0,0 +1 @@ +<svg xmlns="http://www.w3.org/2000/svg"><text dy="20 20">A<tspan style="display: none;">B</tspan></text></svg> diff --git a/layout/svg/crashtests/842909-1.svg b/layout/svg/crashtests/842909-1.svg new file mode 100644 index 0000000000..9a1bc89eb4 --- /dev/null +++ b/layout/svg/crashtests/842909-1.svg @@ -0,0 +1,11 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <defs> + <text id="t">X</text> + </defs> + + <script> + window.addEventListener("load", function() { + document.getElementById("t").getSubStringLength(0, 0); + }, false); + </script> +</svg> diff --git a/layout/svg/crashtests/843072-1.svg b/layout/svg/crashtests/843072-1.svg new file mode 100644 index 0000000000..590721f058 --- /dev/null +++ b/layout/svg/crashtests/843072-1.svg @@ -0,0 +1,11 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <defs> + <text id="t"></text> + </defs> + + <script> + window.addEventListener("load", function() { + document.getElementById("t").getExtentOfChar(0); + }, false); + </script> +</svg> diff --git a/layout/svg/crashtests/843917-1.svg b/layout/svg/crashtests/843917-1.svg new file mode 100644 index 0000000000..55cf7ab186 --- /dev/null +++ b/layout/svg/crashtests/843917-1.svg @@ -0,0 +1,19 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + + <filter id="f"/> + + <g filter="url(#f)"> + <text>a𞠯</text> + </g> + + <script> + + window.addEventListener("load", function() { + var text = document.getElementsByTagName("text")[0]; + text.firstChild.data = "d"; + text.appendChild(document.createElementNS("http://www.w3.org/2000/svg", "g")); + }, false); + + </script> + +</svg> diff --git a/layout/svg/crashtests/847139-1.svg b/layout/svg/crashtests/847139-1.svg new file mode 100644 index 0000000000..81fffa4be8 --- /dev/null +++ b/layout/svg/crashtests/847139-1.svg @@ -0,0 +1,13 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<marker><text>x</text></marker> + +<script> + +window.addEventListener("load", function() { + document.caretPositionFromPoint(0, 0); +}, false); + +</script> + +</svg> diff --git a/layout/svg/crashtests/849688-1.svg b/layout/svg/crashtests/849688-1.svg new file mode 100644 index 0000000000..142f04c933 --- /dev/null +++ b/layout/svg/crashtests/849688-1.svg @@ -0,0 +1,11 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<text></text> + +<script> +window.addEventListener("load", function() { + document.getElementsByTagName('text')[0].getStartPositionOfChar(1); +}, false); +</script> + +</svg> diff --git a/layout/svg/crashtests/849688-2.svg b/layout/svg/crashtests/849688-2.svg new file mode 100644 index 0000000000..4b71b20c7c --- /dev/null +++ b/layout/svg/crashtests/849688-2.svg @@ -0,0 +1,11 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<text>X</text> + +<script> +window.addEventListener("load", function() { + document.getElementsByTagName('text')[0].getStartPositionOfChar(2); +}, false); +</script> + +</svg> diff --git a/layout/svg/crashtests/860378-1.svg b/layout/svg/crashtests/860378-1.svg new file mode 100644 index 0000000000..f4ec09bc4c --- /dev/null +++ b/layout/svg/crashtests/860378-1.svg @@ -0,0 +1,24 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<filter id="f"/> +<g filter="url(#f)"><text>ab</text></g> + +<script> + +function boom() +{ + var svgtext = document.getElementsByTagName("text")[0]; + var text1 = svgtext.firstChild ; + var text2 = text1.splitText(1); + + setTimeout(function() { + text1.data = "c"; + svgtext.removeChild(text2); + }, 200); +} + +window.addEventListener("load", boom, false); + +</script> + +</svg> diff --git a/layout/svg/crashtests/868904-1.svg b/layout/svg/crashtests/868904-1.svg new file mode 100644 index 0000000000..c8d7e9437e --- /dev/null +++ b/layout/svg/crashtests/868904-1.svg @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<style> + +* { animation-name: a; animation-duration: 72ms } +@keyframes a { 60% { transform: skewx(30deg); } } + +</style> +</head> +<body> + +<svg></svg> + +</body> +</html> diff --git a/layout/svg/crashtests/873806-1.svg b/layout/svg/crashtests/873806-1.svg new file mode 100644 index 0000000000..e40aff201b --- /dev/null +++ b/layout/svg/crashtests/873806-1.svg @@ -0,0 +1,10 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <foreignObject requiredFeatures="fail"> + <svg> + <text>a</text> + </svg> + </foreignObject> + <script> + document.querySelector("text").getBBox(); + </script> +</svg> diff --git a/layout/svg/crashtests/876831-1.svg b/layout/svg/crashtests/876831-1.svg new file mode 100644 index 0000000000..6b6c01f9e7 --- /dev/null +++ b/layout/svg/crashtests/876831-1.svg @@ -0,0 +1,18 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<script> + +function boom() +{ + var x = document.getElementById("x").firstChild; + x.data = x.data.slice(1); + document.caretPositionFromPoint(0, 0); +} + +window.addEventListener("load", boom, false); + +</script> + +<text><tspan id="x">@ت</tspan></text> + +</svg> diff --git a/layout/svg/crashtests/877029-1.svg b/layout/svg/crashtests/877029-1.svg new file mode 100644 index 0000000000..1a7bad0f1b --- /dev/null +++ b/layout/svg/crashtests/877029-1.svg @@ -0,0 +1,10 @@ +<!-- + Check that we don't crash due to an nsSVGMarkerFrame having a null + mMarkedFrame and incorrectly calling GetCanvasTM() on the nsSVGMarkerFrame. + --> +<svg xmlns="http://www.w3.org/2000/svg"> + <marker><text>a</text></marker> + <script> + document.querySelector("text").getComputedTextLength(); + </script> +</svg> diff --git a/layout/svg/crashtests/880925-1.svg b/layout/svg/crashtests/880925-1.svg new file mode 100644 index 0000000000..77efd3c0a5 --- /dev/null +++ b/layout/svg/crashtests/880925-1.svg @@ -0,0 +1,26 @@ +<?xml version="1.0"?> + +<svg xmlns="http://www.w3.org/2000/svg"> +<script> +<![CDATA[ + +function boom() +{ + var svgText = document.createElementNS("http://www.w3.org/2000/svg", "text"); + document.documentElement.appendChild(svgText); + var text1 = document.createTextNode("A"); + svgText.appendChild(text1); + var text2 = document.createTextNode(""); + svgText.appendChild(text2); + document.caretPositionFromPoint(0, 0); + setTimeout(function() { + text2.data = "B"; + document.caretPositionFromPoint(0, 0); + }, 0); +} + +window.addEventListener("load", boom, false); + +]]> +</script> +</svg> diff --git a/layout/svg/crashtests/881031-1.svg b/layout/svg/crashtests/881031-1.svg new file mode 100644 index 0000000000..0738e1299d --- /dev/null +++ b/layout/svg/crashtests/881031-1.svg @@ -0,0 +1,15 @@ +<svg xmlns="http://www.w3.org/2000/svg"> +<script> + +function boom() +{ + var svgText = document.getElementById("t"); + svgText.firstChild.data = "C"; + svgText.appendChild(document.createTextNode("D")); + document.caretPositionFromPoint(0, 0); +} +window.addEventListener("load", boom, false); + +</script> +<text id="t">A</text> +</svg> diff --git a/layout/svg/crashtests/885608-1.svg b/layout/svg/crashtests/885608-1.svg new file mode 100644 index 0000000000..0c96777508 --- /dev/null +++ b/layout/svg/crashtests/885608-1.svg @@ -0,0 +1,13 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<mask id="m"><text id="t">z</text></mask> + +<rect width="600" height="400" mask="url(#m)"/> + +<script> +window.addEventListener("load", function() { + document.getElementById("t").firstChild.data = "ab"; +}, false); +</script> + +</svg> diff --git a/layout/svg/crashtests/890782-1.svg b/layout/svg/crashtests/890782-1.svg new file mode 100644 index 0000000000..686bc73a8f --- /dev/null +++ b/layout/svg/crashtests/890782-1.svg @@ -0,0 +1,16 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + + <foreignObject requiredFeatures="foo" id="f"> + <svg> + <text id="t"/> + </svg> + </foreignObject> + + <script> + window.addEventListener("load", function() { + document.documentElement.appendChild(document.getElementById("f")) + document.getElementById("t").getNumberOfChars(); + }, false); + </script> + +</svg> diff --git a/layout/svg/crashtests/890783-1.svg b/layout/svg/crashtests/890783-1.svg new file mode 100644 index 0000000000..25f54ba2a3 --- /dev/null +++ b/layout/svg/crashtests/890783-1.svg @@ -0,0 +1,19 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + + <mask id="m"> + <text> + <tspan id="tspan" /> + </text> + </mask> + + <rect width="600" height="400" mask="url(#m)"/> + + <script> + + window.addEventListener("load", function() { + document.getElementById("tspan").style.dominantBaseline = "alphabetic"; + }, false); + + </script> + +</svg> diff --git a/layout/svg/crashtests/893510-1.svg b/layout/svg/crashtests/893510-1.svg new file mode 100644 index 0000000000..bb58be0450 --- /dev/null +++ b/layout/svg/crashtests/893510-1.svg @@ -0,0 +1,5 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <g requiredExtensions="foo"> + <text>تz</text> + </g> +</svg>
\ No newline at end of file diff --git a/layout/svg/crashtests/895311-1.svg b/layout/svg/crashtests/895311-1.svg new file mode 100644 index 0000000000..7b0c728043 --- /dev/null +++ b/layout/svg/crashtests/895311-1.svg @@ -0,0 +1,17 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + + <mask id="m"> + <text> + <tspan id="ts" /> + </text> + </mask> + + <rect width="600" height="400" mask="url(#m)"/> + + <script> + window.addEventListener("load", function() { + document.getElementById("ts").style.overflow = "hidden"; + }, false); + </script> + +</svg> diff --git a/layout/svg/crashtests/897342-1.svg b/layout/svg/crashtests/897342-1.svg new file mode 100644 index 0000000000..547e919b7d --- /dev/null +++ b/layout/svg/crashtests/897342-1.svg @@ -0,0 +1 @@ +<svg xmlns="http://www.w3.org/2000/svg"><text textLength="50" lengthAdjust="spacingAndGlyphs">‍</text></svg> diff --git a/layout/svg/crashtests/898909-1.svg b/layout/svg/crashtests/898909-1.svg new file mode 100644 index 0000000000..8a70cd7b8d --- /dev/null +++ b/layout/svg/crashtests/898909-1.svg @@ -0,0 +1,11 @@ +<svg xmlns="http://www.w3.org/2000/svg" requiredFeatures="foo"> + + <text id="t" /> + + <script> + window.addEventListener("load", function() { + document.getElementById("t").getComputedTextLength(); + }, false); + </script> + +</svg> diff --git a/layout/svg/crashtests/898951-1.svg b/layout/svg/crashtests/898951-1.svg new file mode 100644 index 0000000000..f42dbf69f2 --- /dev/null +++ b/layout/svg/crashtests/898951-1.svg @@ -0,0 +1,3 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <text>X<tspan style="display: none;">2</tspan>́</text> +</svg> diff --git a/layout/svg/crashtests/913990.html b/layout/svg/crashtests/913990.html new file mode 100644 index 0000000000..21d8ef3cc3 --- /dev/null +++ b/layout/svg/crashtests/913990.html @@ -0,0 +1,5 @@ +<!DOCTYPE html> +<html> +<body style="filter: url('feed:javascript:5');"> +</body> +</html> diff --git a/layout/svg/crashtests/919371-1.xhtml b/layout/svg/crashtests/919371-1.xhtml new file mode 100644 index 0000000000..b27ba3fa66 --- /dev/null +++ b/layout/svg/crashtests/919371-1.xhtml @@ -0,0 +1,5 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> + <svg xmlns="http://www.w3.org/2000/svg"> + <marker style="position: absolute;" /> + </svg> +</html> diff --git a/layout/svg/crashtests/950324-1.svg b/layout/svg/crashtests/950324-1.svg new file mode 100644 index 0000000000..a43d84f4d8 --- /dev/null +++ b/layout/svg/crashtests/950324-1.svg @@ -0,0 +1,3 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <text style="font-family: sans-serif;"> ́</text> +</svg> diff --git a/layout/svg/crashtests/951904-1.html b/layout/svg/crashtests/951904-1.html new file mode 100644 index 0000000000..7a1d1d4dd4 --- /dev/null +++ b/layout/svg/crashtests/951904-1.html @@ -0,0 +1,43 @@ +<body onload="go()"> +<svg> + <switch> + <text id="a">Bonjour</text> + <text id="b">Hello</text> + <a><text id="c">Hello</text></a> + <g> + <mask> + <text>Lundi</text> + </mask> + </g> + <switch> + <text id="d">Au revoir</text> + <g> + <mask> + <text>Mercredi</text> + </mask> + </g> + <text id="e">Goodbye</text> + <a><text id="f">Goodbye</text></a> + </switch> + </switch> +</svg> +<svg> + <switch> + <mask> + <text id="g">Vendredi</text> + </mask> + <a></a> + </switch> +</svg> +</body> +<script> +function go() { + a.getComputedTextLength(); + b.getComputedTextLength(); + c.getComputedTextLength(); + d.getComputedTextLength(); + e.getComputedTextLength(); + f.getComputedTextLength(); + g.getComputedTextLength(); +} +</script> diff --git a/layout/svg/crashtests/952270-1.svg b/layout/svg/crashtests/952270-1.svg new file mode 100644 index 0000000000..69bac47d42 --- /dev/null +++ b/layout/svg/crashtests/952270-1.svg @@ -0,0 +1,9 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> + + <path id="path" transform="scale(2,1)" /> + + <text> + <textPath xlink:href="#path">F</textPath> + </text> + +</svg> diff --git a/layout/svg/crashtests/963086-1.svg b/layout/svg/crashtests/963086-1.svg new file mode 100644 index 0000000000..3805b46d75 --- /dev/null +++ b/layout/svg/crashtests/963086-1.svg @@ -0,0 +1,18 @@ +<svg xmlns="http://www.w3.org/2000/svg" + viewBox="0 0 64 64"> + <defs> + <filter id="dropShadow"> + <feGaussianBlur stdDeviation="2" /> + <feOffset + result="offsetBlur" + dy="1073741824"/> + <feMerge> + <feMergeNode + in="offsetBlur" /> + <feMergeNode + in="SourceGraphic" /> + </feMerge> + </filter> + </defs> + <rect height="64" width="64" style="filter:url(#dropShadow)" /> +</svg> diff --git a/layout/svg/crashtests/974746-1.svg b/layout/svg/crashtests/974746-1.svg new file mode 100644 index 0000000000..c619c25f79 --- /dev/null +++ b/layout/svg/crashtests/974746-1.svg @@ -0,0 +1,9 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + + <pattern id="patternRotated" width="1" patternTransform="rotate(45 50 50)"> + <rect/> + </pattern> + + <rect width="100" height="100" fill="url(#patternRotated)"/> + +</svg> diff --git a/layout/svg/crashtests/975773-1.svg b/layout/svg/crashtests/975773-1.svg new file mode 100644 index 0000000000..dd225eb2ae --- /dev/null +++ b/layout/svg/crashtests/975773-1.svg @@ -0,0 +1,10 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + + <filter id="f"> + <feSpecularLighting style="display: none;"/> + <feComposite in="SourceGraphic"/> + </filter> + + <path d="M0,0 h100 v100 h-100 z M20,20 v60 h60 v-60 z" filter="url(#f)"/> + +</svg> diff --git a/layout/svg/crashtests/979407-1.svg b/layout/svg/crashtests/979407-1.svg new file mode 100644 index 0000000000..b615f3bec2 --- /dev/null +++ b/layout/svg/crashtests/979407-1.svg @@ -0,0 +1,4 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <marker id="marker" viewBox="0 0 10 10" markerHeight="-1px"/> + <path d="M0,0 h10" marker-start="url(#marker)"/> +</svg> diff --git a/layout/svg/crashtests/979407-2.svg b/layout/svg/crashtests/979407-2.svg new file mode 100644 index 0000000000..75aee06345 --- /dev/null +++ b/layout/svg/crashtests/979407-2.svg @@ -0,0 +1,4 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <marker id="marker" viewBox="0 0 10 10" markerWidth="-1px"/> + <path d="M0,0 h10" marker-start="url(#marker)"/> +</svg> diff --git a/layout/svg/crashtests/993443.svg b/layout/svg/crashtests/993443.svg new file mode 100644 index 0000000000..30bd18543c --- /dev/null +++ b/layout/svg/crashtests/993443.svg @@ -0,0 +1,4 @@ +<?xml version="1.0" encoding="UTF-8"?> +<svg xmlns="http://www.w3.org/2000/svg"> +<image width="10" height="10" x="17592186044416pt"/> +</svg>
\ No newline at end of file diff --git a/layout/svg/crashtests/blob-merging-and-retained-display-list.html b/layout/svg/crashtests/blob-merging-and-retained-display-list.html new file mode 100644 index 0000000000..56ca743dc9 --- /dev/null +++ b/layout/svg/crashtests/blob-merging-and-retained-display-list.html @@ -0,0 +1,62 @@ +<!doctype html> +<html class="reftest-wait"> +<script> + var r = 40; + var xmlns = "http://www.w3.org/2000/svg"; + const raf = f => requestAnimationFrame(f); + function rect(x, y) { + var r = document.createElementNS (xmlns, "rect"); + r.setAttribute("x", x); + r.setAttribute("y", y); + r.setAttribute("width", "100"); + r.setAttribute("height", "100"); + r.setAttribute("fill", "blue"); + return r; + } + function f1() { + svg = document.getElementById("cnvs"); + svg.appendChild(rect(0, 0)); + svg.appendChild(rect(600, 0)); + svg.appendChild(rect(600, 400)); + svg.appendChild(rect(0, 400)); + let a = rect(110, 110); + let b = rect(120, 120); + let c = rect(130, 130); + let d = rect(140, 140); + let a2 = rect(310, 140); + let b2 = rect(320, 130); + let c2 = rect(330, 120); + let d2 = rect(340, 110); + raf(() => { + svg.appendChild(a); + svg.appendChild(b); + svg.appendChild(c); + svg.appendChild(d); + raf(() => { + // the display list partial update will end up with these items before x,y,w,z + svg.appendChild(d2); + svg.appendChild(c2); + svg.appendChild(b2); + svg.appendChild(a2); + raf(() => { + // this forces all the items to be ordered and makes the new display list + // contain reorded items outside of the invalid area + let mix = rect(220, 220); + svg.insertBefore(mix, d2); + raf(() => { document.documentElement.className = "" }); + }) + }) + }) + } + + function f() { + requestAnimationFrame(f1); + } + + onload = f; +</script> + +<body> +<svg width="700" height="600" id=cnvs> + +</svg> diff --git a/layout/svg/crashtests/conditional-outer-svg-nondirty-reflow-assert.xhtml b/layout/svg/crashtests/conditional-outer-svg-nondirty-reflow-assert.xhtml new file mode 100644 index 0000000000..b23f064a6c --- /dev/null +++ b/layout/svg/crashtests/conditional-outer-svg-nondirty-reflow-assert.xhtml @@ -0,0 +1,28 @@ +<!-- + Any copyright is dedicated to the Public Domain. + http://creativecommons.org/publicdomain/zero/1.0/ +--> +<html xmlns="http://www.w3.org/1999/xhtml" + xmlns:svg="http://www.w3.org/2000/svg"> +<head> + <title>Test of NS_FRAME_IS_NONDISPLAY / NS_FRAME_IS_DIRTY assertion</title> + <!-- reduced from layout/reftests/svg/svg-integration/conditions-outer-svg-01.xhtml + and modified to occur without bug 1308876 patches. --> + <style> + div { position: relative; height: 100px; width: 100px } + svg { position: absolute; top: 0; left: 0; height: 100%; width: 100% } + </style> + <script> + function run() { + var d = document.getElementById("d"); + d.offsetHeight; + d.style.height = "50px"; + } + </script> +</head> +<body onload="run()"> + <div id="d"> + <svg:svg systemLanguage="x"></svg:svg> + </div> +</body> +</html> diff --git a/layout/svg/crashtests/crashtests.list b/layout/svg/crashtests/crashtests.list new file mode 100644 index 0000000000..4b898383cf --- /dev/null +++ b/layout/svg/crashtests/crashtests.list @@ -0,0 +1,256 @@ +load 220165-1.svg +load 267650-1.svg +load 294022-1.svg +load 307314-1.svg +load 308615-1.svg +load 308917-1.svg +load 310436-1.svg +load 310638.svg +load 313737-1.xml +load chrome://reftest/content/crashtests/layout/svg/crashtests/314244-1.xhtml +load 322185-1.svg +load 322215-1.svg +load 323704-1.svg +load 325427-1.svg +load 326495-1.svg +load 326974-1.svg +load 327706-1.svg +load 327711-1.svg +load 328137-1.svg +load 329848-1.svg +load chrome://reftest/content/crashtests/layout/svg/crashtests/337408-1.xhtml +load 338301-1.xhtml +load 338312-1.xhtml +load 340083-1.svg +load 340945-1.svg +load 342923-1.html +load 343221-1.xhtml +load 344749-1.svg +load 344887-1.svg +load 344892-1.svg +load 344898-1.svg +load 344904-1.svg +load 345418-1.svg +load 348982-1.xhtml +load 354777-1.xhtml +load 359516-1.svg +load 361015-1.svg +load 361587-1.svg +load 363611-1.xhtml +load 364688-1.svg +load 366956-1.svg +load 366956-2.svg +load 367111-1.svg +load 367368-1.xhtml +load 369233-1.svg +load 369438-1.svg +load 369438-2.svg +load 371463-1.xhtml +load 371563-1.xhtml +load 375775-1.svg +load 378716.svg +load 380691-1.svg +load 384391-1.xhtml +load 384499-1.svg +load 384637-1.svg +load 384728-1.svg +load 385246-1.svg +load 385246-2.svg +load 385552-1.svg +load 385552-2.svg +load 385840-1.svg +load 385852-1.svg +load 386475-1.xhtml +load 386690-1.svg +load 387290-1.svg +load 402408-1.svg +load 404677-1.xhtml +load 409565-1.xhtml +load 420697-1.svg +load 420697-2.svg +load 429774-1.svg +load 441368-1.svg +load 453754-1.svg +load 455314-1.xhtml +load 458453.html +load 459666-1.html +load 459883.xhtml +load 461289-1.svg +load 464374-1.svg +load 466585-1.svg +load 467323-1.svg +load 467498-1.svg +load 470124-1.svg +load 472782-1.svg +load 474700-1.svg +load 475181-1.svg +load 475193-1.html +load 475302-1.svg +load 477935-1.html +load 478128-1.svg +load 478511-1.svg +load 483439-1.svg +load 492186-1.svg +load 508247-1.svg +load 512890-1.svg +load 515288-1.html +load 522394-1.svg +load 522394-2.svg +load 522394-3.svg +load 566216-1.svg +load 587336-1.html +load 590291-1.svg +load 601999-1.html +load 605626-1.svg +asserts(2) load 606914.xhtml # bug 606914, bug 718883 +load 610594-1.html +load 610954-1.html +load 612662-1.svg +load 612662-2.svg +load 612736-1.svg +load 612736-2.svg +load 614367-1.svg +load 620034-1.html +load 621598-1.svg +load 648819-1.html +load 655025-1.svg +load 655025-2.svg +load 655025-3.svg +load 657077-1.svg +load 669025-1.svg +load 669025-2.svg +load 682411-1.svg +load 692203-1.svg +load 692203-2.svg +load 693424-1.svg +load 709920-1.svg +load 709920-2.svg +load 713413-1.svg +load 722003-1.svg +load 725918-1.svg +load 732836-1.svg +load 740627-1.svg +load 740627-2.svg +load 743469.svg +load 757704-1.svg +load 757718-1.svg +load 757751-1.svg +load 767056-1.svg +load 767535-1.xhtml +load 768087-1.html +load 768351.svg +load 772313-1.svg +load 778492-1.svg +load 779971-1.svg +load 780764-1.svg +load 780963-1.html +load 782141-1.svg +load 784061-1.svg +load 788831-1.svg +load 789390-1.html +load 790072.svg +load 791826-1.svg +load 808318-1.svg +load 803562-1.svg +load 813420-1.svg +load 841163-1.svg +load 841812-1.svg +load 842009-1.svg +load 842630-1.svg +load 842909-1.svg +load 843072-1.svg +load 843917-1.svg +load 847139-1.svg +load 849688-1.svg +load 849688-2.svg +load 860378-1.svg +load 868904-1.svg +load 873806-1.svg +load 876831-1.svg +load 877029-1.svg +load 880925-1.svg +load 881031-1.svg +load 885608-1.svg +load 890782-1.svg +load 890783-1.svg +load 893510-1.svg +load 895311-1.svg +load 897342-1.svg +load 898909-1.svg +load 898951-1.svg +load 913990.html +load 919371-1.xhtml +load 950324-1.svg +load 951904-1.html +load 952270-1.svg +load 963086-1.svg +load 974746-1.svg +load 975773-1.svg +load 979407-1.svg +load 979407-2.svg +load 993443.svg +load 1016145.svg +load 1028512.svg +load 1140080-1.svg +load 1149542-1.svg +load 1156581-1.svg +load 1182496-1.html +load 1209525-1.svg +load 1223281-1.svg +load 1234726-1.svg +load 1322537-1.html +load 1322537-2.html +load 1322852.html +load 1348564.svg +load 1402109.html +load 1402124.html +load 1402486.html +load 1403656-1.html +load 1403656-2.html +load 1403656-3.html +load 1403656-4.html +load 1403656-5.html +load 1404086.html +load 1421807-1.html +load 1421807-2.html +load 1422226.html +load 1425434-1.html +load 1443092.html +load 1454201-1.html +load 1467552-1.html +load 1474982.html +load conditional-outer-svg-nondirty-reflow-assert.xhtml +load extref-test-1.xhtml +load blob-merging-and-retained-display-list.html +load empty-blob-merging.html +load grouping-empty-bounds.html +load 1480275.html +load 1480224.html +load 1502936.html +load 1504918.svg +load perspective-invalidation.html +load invalid_url.html +load 1535517-1.svg +load 1504072.html +load 1072758.html +load 1536892.html +load 1539318-1.svg +load 1548985-1.html +load 1548985-2.svg +load 1555851.html +load invalidation-of-opacity-0.html +load 1563779.html +load 1600855.html +load 1601824.html +load 1605223-1.html +load 1609663.html +skip-if(Android) load 1671950.html # No print-preview support on android +load 1678947.html +load 1693032.html +load 1696505.html +load 1758029-1.html +HTTP load 1755770-1.html +HTTP load 1755770-2.html +load 1764936-1.html +load 1804958.html +load 1810260.html diff --git a/layout/svg/crashtests/empty-blob-merging.html b/layout/svg/crashtests/empty-blob-merging.html new file mode 100644 index 0000000000..4b603c19d9 --- /dev/null +++ b/layout/svg/crashtests/empty-blob-merging.html @@ -0,0 +1,48 @@ +<html class="reftest-wait"> +<style> +@keyframes spinnow { + 100% { + transform: rotate(360deg) scale(.2, .2); + } +} + +rect { + transform: rotate(0deg) scale(0.6, 1); + transform-origin: center; + animation: 5s spinnow infinite linear; +} + +</style> +<svg width=400 height=400> + <!-- + onwheel is needed so that we get a hit test info display item + before the transform on the rect + --> + <g onwheel="alert(1)"> + <g id="gr"> + <circle r=30 fill=yellow cx=300 cy=100 /> + <circle r=30 fill=yellow cx=10 cy=100 /> + <circle r=30 fill=yellow cx=300 cy=300 /> + <circle r=30 fill=yellow cx=10 cy=300 /> + </g> + <rect width=100 height=100 fill=blue x=100 y=100 /> + <g opacity=0.5> + <circle r=30 fill=pink cx=300 cy=100 /> + <circle r=30 fill=pink cx=10 cy=100 /> + <circle r=30 fill=pink cx=300 cy=300 /> + <circle r=30 fill=pink cx=10 cy=300 /> + </g> + </g> +</svg> +<script> + function blam() { + let gr = document.getElementById("gr"); + gr.remove(); + document.documentElement.removeAttribute("class"); + } +document.addEventListener("MozReftestInvalidate", function() { + requestAnimationFrame(function() { + blam(); + }); +}); +</script> diff --git a/layout/svg/crashtests/extref-test-1-resource.xhtml b/layout/svg/crashtests/extref-test-1-resource.xhtml new file mode 100644 index 0000000000..cd47ddc2f5 --- /dev/null +++ b/layout/svg/crashtests/extref-test-1-resource.xhtml @@ -0,0 +1,24 @@ +<!-- + Any copyright is dedicated to the Public Domain. + http://creativecommons.org/licenses/publicdomain/ +--> +<html xmlns="http://www.w3.org/1999/xhtml" + xmlns:svg="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink"> +<body style="margin:0"> + <embed type="application/x-shockwave-flash" src="data:application/x-shockwave-flash,This is a test"></embed> + <iframe src="date:text/plain,aaa"></iframe> + <div style="mask: url(#m1); width:500px; height:500px; background:lime;"></div> + + <svg:svg height="0"> + <svg:mask id="m1" maskUnits="objectBoundingBox" maskContentUnits="objectBoundingBox"> + <svg:linearGradient id="g" gradientUnits="objectBoundingBox" x2="0" y2="1"> + <svg:stop stop-color="white" offset="0"/> + <svg:stop stop-color="white" stop-opacity="0" offset="1"/> + </svg:linearGradient> + <svg:circle cx="0.25" cy="0.25" r="0.25" id="circle" fill="white"/> + <svg:rect x="0.5" y="0" width="0.5" height="1" fill="url(#g)"/> + </svg:mask> + </svg:svg> +</body> +</html> diff --git a/layout/svg/crashtests/extref-test-1.xhtml b/layout/svg/crashtests/extref-test-1.xhtml new file mode 100644 index 0000000000..932b679b1f --- /dev/null +++ b/layout/svg/crashtests/extref-test-1.xhtml @@ -0,0 +1,11 @@ +<!-- + Any copyright is dedicated to the Public Domain. + http://creativecommons.org/licenses/publicdomain/ +--> +<html xmlns="http://www.w3.org/1999/xhtml" + xmlns:svg="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink"> +<body style="margin:0"> + <div style="mask: url(extref-test-1-resource.xhtml#m1); width:500px; height:500px; background:lime;"></div> +</body> +</html> diff --git a/layout/svg/crashtests/grouping-empty-bounds.html b/layout/svg/crashtests/grouping-empty-bounds.html new file mode 100644 index 0000000000..c9f688d0f0 --- /dev/null +++ b/layout/svg/crashtests/grouping-empty-bounds.html @@ -0,0 +1,41 @@ +<!DOCTYPE html> +<html lang="en" class='reftest-wait'> +<meta charset="utf-8"> +<title>This testcase might create a non-empty display list with an empty set of drawing commands / items in the EventRecorder</title> + +<style> + +body { + margin: 0; +} + +.animated-opacity { + animation: opacity-animation 1s linear alternate infinite; +} + +@keyframes opacity-animation { + from { + opacity: 0; + } + to { + opacity: 1; + } +} + +</style> + +<svg style="width: 100px; height: 100px;"> + <rect class="animated-opacity" x="0" y="0" width="100" height="100"/> + <rect x="0" y="0" width="10" height="10" id="toremove"/> + <g transform="translate(10 10)"><rect x="120" y="0" width="1" height="1"/></g> +</svg> + +<script> + +window.addEventListener("MozReftestInvalidate", () => { + var elem = document.getElementById("toremove"); + elem.parentNode.removeChild(elem); + document.documentElement.removeAttribute('class'); +}); + +</script> diff --git a/layout/svg/crashtests/invalid_url.html b/layout/svg/crashtests/invalid_url.html new file mode 100644 index 0000000000..ac8671b1ce --- /dev/null +++ b/layout/svg/crashtests/invalid_url.html @@ -0,0 +1,11 @@ +<!DOCTYPE html> +<html> +<head></head> +<body> + <!-- + If invalid url isn't correctly handled, this test will crash when + gfx.webrender.enabled=true and gfx.webrender.all=true + --> + <div style="padding: 1px; filter:url('data://not-valid-data');"></div> +</body> +</html> diff --git a/layout/svg/crashtests/invalidation-of-opacity-0.html b/layout/svg/crashtests/invalidation-of-opacity-0.html new file mode 100644 index 0000000000..50700e3908 --- /dev/null +++ b/layout/svg/crashtests/invalidation-of-opacity-0.html @@ -0,0 +1,26 @@ +<html class="reftest-wait"> + <script> + var i = 0; + var opac = [0.3, 0.2, 0, 0.3]; + + function f() { + document.getElementById("rim").setAttribute("opacity", opac[i]); + document.getElementById("circ").setAttribute("r", i + 10); + i++; + if (i > opac.length) { + document.documentElement.className = "" + } else { + requestAnimationFrame(f); + } + } + onload = () => requestAnimationFrame(f); +</script> + +<body> + <svg height="1000" width="1000"> + <circle cx="50" cy="50" r="40" fill="red" /> + <g id=rim clip-path="url(#myClip)" opacity=0> + <circle id="circ" cx="150" cy="150" r="40" fill="red" /> + </g> + <circle cx="250" cy="250" r="40" fill="red" /> + </svg> diff --git a/layout/svg/crashtests/masked-3d-transform.html b/layout/svg/crashtests/masked-3d-transform.html new file mode 100644 index 0000000000..6c70aae7fe --- /dev/null +++ b/layout/svg/crashtests/masked-3d-transform.html @@ -0,0 +1,20 @@ +<style> + svg, +svg * { + perspective: 1000px; +} +</style> +<svg style="max-width: 176px;" viewBox="0 0 279 169"> + <g transform="translate(-2.000000, -2.000000)"> + <g mask="url(#mask-2)"> + <g transform="translate(19.000000, 22.000000)"> + <g fill="#FFFFFF"> + <path d="M43,2.3 C41,2.3 39.9,3.3 39.9,5.6 L39.9,12.4 C39.9,14.7 41,15.7 43.1,15.7 C45.7,15.7 45.9,14.1 46.1,13 C46.1,12.7 46.4,12.4 46.8,12.4 C47.3,12.4 47.5,12.6 47.5,13.3 C47.5,15.3 45.8,17 42.9,17 C40.4,17 38.4,15.7 38.4,12.3 L38.4,5.5 C38.4,2.1 40.5,0.9 43,0.9 C45.9,0.9 47.5,2.6 47.5,4.5 C47.5,5.2 47.3,5.4 46.8,5.4 C46.3,5.4 46.1,5.2 46.1,4.9 C46.1,4 45.6,2.3 43,2.3 L43,2.3 Z"></path> + </g> + </g> + <ellipse fill="#000000" cx="157.9" cy="162.1" rx="157.9" ry="4.3"></ellipse> + </g> + </g> +</svg> + + diff --git a/layout/svg/crashtests/perspective-invalidation.html b/layout/svg/crashtests/perspective-invalidation.html new file mode 100644 index 0000000000..179836d500 --- /dev/null +++ b/layout/svg/crashtests/perspective-invalidation.html @@ -0,0 +1,9 @@ +<span> +<svg id="a" transform="skewX(0)" opacity="0"> +<text> +</span> +<marquee> +A +</marquee> +<svg xml:space="preserve"> +<use style="outline: auto; -webkit-perspective: 1px" xlink:href="#a" mask="url(#x)"> |
