diff options
Diffstat (limited to 'parser/htmlparser/tests/crashtests')
72 files changed, 1134 insertions, 0 deletions
diff --git a/parser/htmlparser/tests/crashtests/121591-1.html b/parser/htmlparser/tests/crashtests/121591-1.html new file mode 100644 index 0000000000..b411a18518 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/121591-1.html @@ -0,0 +1,22 @@ +<HTML>
+<body>
+<span>
+<head><link></head>
+ <table border=1>
+ <tr><td>
+ <table border=1 align="left">
+ <tr><td></td></tr>
+ <tr><td>
+ <form>
+ <button></button>
+ </form>
+ </td></tr>
+ </table>
+ </td></tr>
+ </table>
+</span>
+</body>
+</html>
+
+
+
diff --git a/parser/htmlparser/tests/crashtests/1373045-1.html b/parser/htmlparser/tests/crashtests/1373045-1.html new file mode 100644 index 0000000000..d0bea2fa44 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/1373045-1.html @@ -0,0 +1 @@ +<object data="data:image/svg+xml;charset=ISO-2022-KR,%30"></object> diff --git a/parser/htmlparser/tests/crashtests/147179-1.html b/parser/htmlparser/tests/crashtests/147179-1.html new file mode 100644 index 0000000000..2aaac19844 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/147179-1.html @@ -0,0 +1,7 @@ +<html><head><title>Testcase for bug 141561</title></head>
+<body>
+
+<script>document.write("<form><input type='password'></form>");</script>
+
+</body>
+</html>
diff --git a/parser/htmlparser/tests/crashtests/151956-1.html b/parser/htmlparser/tests/crashtests/151956-1.html new file mode 100644 index 0000000000..0ae77f6a6c --- /dev/null +++ b/parser/htmlparser/tests/crashtests/151956-1.html @@ -0,0 +1,18 @@ +<html> +<body> +<!-- script isn't actually required for the crash of bug 151956 --> +<table border> + <tbody> + <form> + <script> + var foo = 42; + </script> + </form> + <tr> + <td> X </td> + </tr> + </tbody> +</table> +</body> +</html> + diff --git a/parser/htmlparser/tests/crashtests/152444-1.html b/parser/htmlparser/tests/crashtests/152444-1.html new file mode 100644 index 0000000000..6576444544 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/152444-1.html @@ -0,0 +1,15 @@ +<html>
+<head>
+<title>Untitled</title>
+</head>
+<body>
+<table>
+<tbody>
+<form>
+<tr><td colspan=2></td></tr>
+<tr><td></td><td></td></tr>
+</form>
+</tbody>
+</table>
+</body>
+</html>
diff --git a/parser/htmlparser/tests/crashtests/1534346-1.html b/parser/htmlparser/tests/crashtests/1534346-1.html new file mode 100644 index 0000000000..34ab7930db --- /dev/null +++ b/parser/htmlparser/tests/crashtests/1534346-1.html @@ -0,0 +1 @@ +<svg><script></svg> diff --git a/parser/htmlparser/tests/crashtests/1547895-1.html b/parser/htmlparser/tests/crashtests/1547895-1.html new file mode 100644 index 0000000000..72d19c6caa --- /dev/null +++ b/parser/htmlparser/tests/crashtests/1547895-1.html @@ -0,0 +1,10 @@ +<script> +var func0 = async function(a) { + a.currentTarget.close() +} +document.addEventListener('DOMContentLoaded', () => { + document.write() + document.addEventListener('readystatechange', func0, true) + setTimeout(window.close, 0) +}) +</script> diff --git a/parser/htmlparser/tests/crashtests/1604307-1.html b/parser/htmlparser/tests/crashtests/1604307-1.html new file mode 100644 index 0000000000..28a2e7caf0 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/1604307-1.html @@ -0,0 +1,10 @@ +<script> +function go() { + b.crossOrigin = "" + document.execCommand("insertHTML", false, c.innerHTML) +} +</script> +<image id="b" src="data:;base64,R0lGODlhIAAgAPIBAGbMzP///wAAADOZZpn/zAAAAAAAAAAAACH5BAAAAAAALAAAAAAgACAAAA" onload="go()"></image> +<data id="c"> +<s contenteditable="true" +<!-- A --> diff --git a/parser/htmlparser/tests/crashtests/1606499-1.html b/parser/htmlparser/tests/crashtests/1606499-1.html new file mode 100644 index 0000000000..5771d73d8d --- /dev/null +++ b/parser/htmlparser/tests/crashtests/1606499-1.html @@ -0,0 +1,15 @@ +<html class="reftest-wait"> +<script> +let alreadyRun = sessionStorage.getItem("ran1606499"); +if (alreadyRun) { + document.documentElement.removeAttribute("class"); +} else { + sessionStorage.setItem("ran1606499", "ran1606499"); + document.addEventListener('DOMContentLoaded', () => { + setTimeout(() => { document.close() }, 146) + setTimeout(() => { location.reload() }, 145) + self.stop() + document.write('<body></body>') + }) +} +</script> diff --git a/parser/htmlparser/tests/crashtests/1747514.html b/parser/htmlparser/tests/crashtests/1747514.html new file mode 100644 index 0000000000..e8a93b9280 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/1747514.html @@ -0,0 +1,13 @@ +<!DOCTYPE html> +<html> + <head> + <script> + // Generate an SVG data URI whose URI string will consume 20 MB in expat + // (which uses two-byte chars). + let img = document.createElement('img'); + let rect = "<rect />"; + let src = "data:image/svg+xml;utf8,<svg>" + rect.repeat(20 * 1000 * 1000 / rect.length / 2) + "</svg>"; + img.src = src; + document.body.appendChild(img); + </script> + diff --git a/parser/htmlparser/tests/crashtests/185073-1.html b/parser/htmlparser/tests/crashtests/185073-1.html new file mode 100644 index 0000000000..39504ede22 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/185073-1.html @@ -0,0 +1,15 @@ +<html> + <head> + <title>bug 185073</title> + </head> + <body> + <font> + <div id="updateText"> + <script language=javascript type=text/javascript> + document.write('</div>'); + document.getElementById("updateText").innerHTML = "foo"; + </script> + </div> + </font> + </body> +</html> diff --git a/parser/htmlparser/tests/crashtests/188474-1.html b/parser/htmlparser/tests/crashtests/188474-1.html new file mode 100644 index 0000000000..2e8b03d197 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/188474-1.html @@ -0,0 +1,13 @@ +<HTML><HEAD>
+<SCRIPT language="javascript" type="text/javascript">
+
+var header ="<body><div id=\"foo\"></div><div id=\"foo2\"><!-- comment -->";
+
+var footer = "</div><!-- comment -->";
+
+</SCRIPT>
+<SCRIPT language="javascript" type="text/javascript">document.write(header);</SCRIPT>
+</HEAD>
+<BODY>
+<SCRIPT language="javascript" type="text/javascript">document.write(footer);</SCRIPT>
+</BODY></HTML>
diff --git a/parser/htmlparser/tests/crashtests/194329-1.html b/parser/htmlparser/tests/crashtests/194329-1.html new file mode 100644 index 0000000000..c7ab69007e --- /dev/null +++ b/parser/htmlparser/tests/crashtests/194329-1.html @@ -0,0 +1,15 @@ +<html> + <head> + <title>bug 188474</title> + </head> + <body> + <head> + <div> + <script> + document.write("<\/div>"); + </script> + <noscript> + </div> + </noscript><!-- End PayPal Logo --> + </body> +</html> diff --git a/parser/htmlparser/tests/crashtests/197052-1.html b/parser/htmlparser/tests/crashtests/197052-1.html new file mode 100644 index 0000000000..d0b30c761b --- /dev/null +++ b/parser/htmlparser/tests/crashtests/197052-1.html @@ -0,0 +1 @@ +<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">
<html>
<head>
<title>testcase - crasher</title>
</head>
<body>
<div id="uniqid">
<script language="JavaScript" type="text/JavaScript">
document.write(">"+document.getElementById('uniqid').innerHTML+"<");
</script>
</div>
</body>
</html>
\ No newline at end of file diff --git a/parser/htmlparser/tests/crashtests/220542-1.html b/parser/htmlparser/tests/crashtests/220542-1.html new file mode 100644 index 0000000000..f664734664 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/220542-1.html @@ -0,0 +1,2 @@ +<script>document.write('<link href="l:\\" rel=stylesheet>')</script> + diff --git a/parser/htmlparser/tests/crashtests/253979-1.html b/parser/htmlparser/tests/crashtests/253979-1.html new file mode 100644 index 0000000000..5e47ee84c9 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/253979-1.html @@ -0,0 +1,4 @@ +<html><head></head><body>
+<a><a><p><font><p><font><b><a></font></a>
+</body></html>
+
diff --git a/parser/htmlparser/tests/crashtests/269095-1.html b/parser/htmlparser/tests/crashtests/269095-1.html new file mode 100644 index 0000000000..83cc52828e --- /dev/null +++ b/parser/htmlparser/tests/crashtests/269095-1.html @@ -0,0 +1 @@ +<TABLE >
<FRAMESET>
<PARAM>
<FORM>
<MAP>
<FORM>
<TABLE>
<RTABLE>
\ No newline at end of file diff --git a/parser/htmlparser/tests/crashtests/286733-1.html b/parser/htmlparser/tests/crashtests/286733-1.html new file mode 100644 index 0000000000..04be4f11d3 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/286733-1.html @@ -0,0 +1,4 @@ +<TABLE> +<FRAMESET><FRAME></FRAMESET> +<TR><TD><TABLE> + <TR><BR><TD><MAP><TABLE><BR></MAP> diff --git a/parser/htmlparser/tests/crashtests/286733-2.html b/parser/htmlparser/tests/crashtests/286733-2.html new file mode 100644 index 0000000000..5fcf7a7ff9 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/286733-2.html @@ -0,0 +1,4 @@ +<TABLE> +<FRAMESET><FRAME></FRAMESET> +<TR><TD><TABLE> + <TR><BR><TD><MAP><TABLE><TR><BR></MAP> diff --git a/parser/htmlparser/tests/crashtests/299036-1.html b/parser/htmlparser/tests/crashtests/299036-1.html new file mode 100644 index 0000000000..e21ce2b9b7 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/299036-1.html @@ -0,0 +1,2 @@ +<table><textarea></textarea></table> + diff --git a/parser/htmlparser/tests/crashtests/30885-1.html b/parser/htmlparser/tests/crashtests/30885-1.html new file mode 100644 index 0000000000..2dc0fe035d --- /dev/null +++ b/parser/htmlparser/tests/crashtests/30885-1.html @@ -0,0 +1,17 @@ +<HTML> + <BODY> + + <TABLE BORDER="1"> + <TR> + <TD> + <A HREF="foo.htm"> + <FONT></A> + <A HREF="bar.htm"> + <FONT> + MacDesktops</A> + </FONT> + </TD> + </TR> +</TABLE> +</BODY> +</HTML> diff --git a/parser/htmlparser/tests/crashtests/30956-1.html b/parser/htmlparser/tests/crashtests/30956-1.html new file mode 100644 index 0000000000..508149a97d --- /dev/null +++ b/parser/htmlparser/tests/crashtests/30956-1.html @@ -0,0 +1,10 @@ +<HTML>
+
+<body>
+<table>
+ <td>
+ <li><font size="-1">
+ <li><a href="foo.html"></font></a>
+</table>
+</body>
+</html>
\ No newline at end of file diff --git a/parser/htmlparser/tests/crashtests/31392-1.html b/parser/htmlparser/tests/crashtests/31392-1.html new file mode 100644 index 0000000000..0a4a138b34 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/31392-1.html @@ -0,0 +1,15 @@ +<html> +<head> +<title>Crash Test page</title> +</head> +<body> + +<table> +<tr> +<td> +<LINK REL="stylesheet" HREF="garbagestyle.css" TYPE="text/css"> +</td> +</tr> +</table> +</body> +</html>
\ No newline at end of file diff --git a/parser/htmlparser/tests/crashtests/31694-1.html b/parser/htmlparser/tests/crashtests/31694-1.html new file mode 100644 index 0000000000..8be2d47f02 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/31694-1.html @@ -0,0 +1,8 @@ +<HTML><HEAD>
+<script src="foo.js"></script>
+<csactions>
+<csaction name="bar" class="foobar" type="ONEVENT">
+</csactions>
+</HEAD>
+<BODY>
+<DD></DD></BODY></HTML>
diff --git a/parser/htmlparser/tests/crashtests/31940-1.html b/parser/htmlparser/tests/crashtests/31940-1.html new file mode 100644 index 0000000000..ec2f370e83 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/31940-1.html @@ -0,0 +1,15 @@ +<HEAD> + <LINK rel="stylesheet"> + <rdf:RDF> + <rdf:Description/> + </rdf:RDF> +</HEAD> + +<BODY> + +<rdf:RDF> +<rdfs:Class/> +</rdf:RDF> + +</BODY> +</HTML> diff --git a/parser/htmlparser/tests/crashtests/32613-1.html b/parser/htmlparser/tests/crashtests/32613-1.html new file mode 100644 index 0000000000..f50c342e9f --- /dev/null +++ b/parser/htmlparser/tests/crashtests/32613-1.html @@ -0,0 +1,18 @@ +<P><font color="003366" FACE="Serif"> +<P><FONT size="2"></P> +<P><FONT size="2"></P> +<P><FONT size="2"></P> +<P><FONT size="2"></P> +<P><FONT size="2"></P> +<P><FONT size="2"></P> +<P><FONT size="2"></P> +<P><FONT size="2"></P> +<P><FONT size="2"></P> +<P><FONT size="2"></P> +<P><FONT size="2"></P> +<P><FONT size="2"></P> +<P><FONT size="2"></P> +<P><FONT size="2"></P> +<P><FONT size="2"></P> +<P><FONT size="2"></P> +</FONT><BR> diff --git a/parser/htmlparser/tests/crashtests/328751-1.html b/parser/htmlparser/tests/crashtests/328751-1.html new file mode 100644 index 0000000000..37b46af345 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/328751-1.html @@ -0,0 +1,9 @@ +<HEAD > +<OBJECT > +<APPLET CODE=" > +<BODY TEXT=https://n%ItGEv5%&N8%6USN5i9" +<TABLE > +<ISINDEX > +<TITLE > +<TBODY > +</HEAD >
\ No newline at end of file diff --git a/parser/htmlparser/tests/crashtests/34168-1.html b/parser/htmlparser/tests/crashtests/34168-1.html new file mode 100644 index 0000000000..a191a03681 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/34168-1.html @@ -0,0 +1 @@ +<!ENTITY editAwayMessageSpecial3.label " %d = Current date">
\ No newline at end of file diff --git a/parser/htmlparser/tests/crashtests/34168-1.xml b/parser/htmlparser/tests/crashtests/34168-1.xml new file mode 100644 index 0000000000..71a058c316 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/34168-1.xml @@ -0,0 +1,6 @@ +<?xml version="1.0"?> +<!DOCTYPE foo [ +<!ENTITY editAwayMessageSpecial3.label " %%d = Current date"> +<!ELEMENT foo EMPTY> +]> +<foo/> diff --git a/parser/htmlparser/tests/crashtests/408939-1.html b/parser/htmlparser/tests/crashtests/408939-1.html new file mode 100644 index 0000000000..844c70e72e --- /dev/null +++ b/parser/htmlparser/tests/crashtests/408939-1.html @@ -0,0 +1,139 @@ +<!DOCTYPE html> +<html> +<head> +</head> +<body> + +<div> +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx +</div> + +<meta http-equiv="Content-Type" content="text/html;charset=utf-8"> + +</body> +</html> diff --git a/parser/htmlparser/tests/crashtests/41427-1.html b/parser/htmlparser/tests/crashtests/41427-1.html new file mode 100644 index 0000000000..5612153da5 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/41427-1.html @@ -0,0 +1 @@ +<A HREF=""><font><B>t</A><head><script>
diff --git a/parser/htmlparser/tests/crashtests/423373-1.html b/parser/htmlparser/tests/crashtests/423373-1.html new file mode 100644 index 0000000000..4876095480 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/423373-1.html @@ -0,0 +1 @@ +<body><asdf><legend> diff --git a/parser/htmlparser/tests/crashtests/44178-1.html b/parser/htmlparser/tests/crashtests/44178-1.html new file mode 100644 index 0000000000..0ecb40ef77 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/44178-1.html @@ -0,0 +1,8 @@ +<html>
+<body>
+<div>
+<server>
+</server>
+</div>
+</body>
+</html>
diff --git a/parser/htmlparser/tests/crashtests/445171-1-inner.svg b/parser/htmlparser/tests/crashtests/445171-1-inner.svg new file mode 100644 index 0000000000..24ed6f8a70 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/445171-1-inner.svg @@ -0,0 +1,5 @@ +<svg xmlns="http://www.w3.org/2000/svg" onload="location = 'file_445171-1.html'"> + +<rect x="5" y="5" width="50" height="50" /> + +</svg> diff --git a/parser/htmlparser/tests/crashtests/445171-1.html b/parser/htmlparser/tests/crashtests/445171-1.html new file mode 100644 index 0000000000..0abaacdfba --- /dev/null +++ b/parser/htmlparser/tests/crashtests/445171-1.html @@ -0,0 +1,9 @@ +<html class="reftest-wait"> +<head> +<script> +function done() { document.documentElement.removeAttribute("class"); } +</script> +<body> +<iframe src="445171-1-inner.svg"></iframe> +</body> +</html> diff --git a/parser/htmlparser/tests/crashtests/46495-1.html b/parser/htmlparser/tests/crashtests/46495-1.html new file mode 100644 index 0000000000..a0947ff2ca --- /dev/null +++ b/parser/htmlparser/tests/crashtests/46495-1.html @@ -0,0 +1,5 @@ +<html> + <body> + <p "> + </body> +</html> diff --git a/parser/htmlparser/tests/crashtests/468538-1.xhtml b/parser/htmlparser/tests/crashtests/468538-1.xhtml new file mode 100644 index 0000000000..576b333c19 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/468538-1.xhtml @@ -0,0 +1,15 @@ +<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"> +<head> +<script type="text/javascript"> + +function boom() +{ + var v = document.getElementById("v"); + document.body.removeChild(document.body.firstChild); + v.innerHTML = "f"; +} + +</script> +</head> +<body onload="boom();"><xul:box><div id="v"/></xul:box></body> +</html> diff --git a/parser/htmlparser/tests/crashtests/50134-1.html b/parser/htmlparser/tests/crashtests/50134-1.html new file mode 100644 index 0000000000..efe680a1f4 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/50134-1.html @@ -0,0 +1,8 @@ +<html> + <head> + <title>Mozilla Bug 50134</title> + </head> + <body> + <!---> + </body> +</html> diff --git a/parser/htmlparser/tests/crashtests/502103.html b/parser/htmlparser/tests/crashtests/502103.html new file mode 100644 index 0000000000..171a2890e5 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/502103.html @@ -0,0 +1 @@ +<isindex action="">
\ No newline at end of file diff --git a/parser/htmlparser/tests/crashtests/502869-iframe.html b/parser/htmlparser/tests/crashtests/502869-iframe.html new file mode 100644 index 0000000000..ff76e020bf --- /dev/null +++ b/parser/htmlparser/tests/crashtests/502869-iframe.html @@ -0,0 +1,9 @@ +<html><head><title>[HTML5] Crash [@ nsHtml5TreeBuilder::appendToCurrentNodeAndPushElementMayFoster] with document.write and removing stuff</title></head><body><a> +<script> +var x=document.getElementsByTagName("*"); +x[1].remove(); +x[2].remove(); +</script> +<div> +<script>document.write('<'+'script>document.removeChild(document.documentElement);<'+'/script>');</script> +</a></body></html> diff --git a/parser/htmlparser/tests/crashtests/502869.html b/parser/htmlparser/tests/crashtests/502869.html new file mode 100644 index 0000000000..5da23b5076 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/502869.html @@ -0,0 +1,18 @@ +<!DOCTYPE HTML> +<html class="reftest-wait"><head> + <meta charset="utf-8"> + <title>Testcase for bug 502869</title> +<script> +function done() +{ + document.documentElement.removeAttribute("class"); +} +</script> +</head> +<body onload="setTimeout(done,1000)"> + +<iframe src="502869-iframe.html"></iframe> + + +</body> +</html> diff --git a/parser/htmlparser/tests/crashtests/50994-1.html b/parser/htmlparser/tests/crashtests/50994-1.html new file mode 100644 index 0000000000..11bd9aaf07 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/50994-1.html @@ -0,0 +1,12 @@ +<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> +<HTML> + <HEAD> + <TITLE>Mozilla Bug 50994</TITLE> + </HEAD> + <BODY> + <P> + <FORM action=""> + <P> + </FORM> + </BODY> +</HTML> diff --git a/parser/htmlparser/tests/crashtests/515278-1.html b/parser/htmlparser/tests/crashtests/515278-1.html new file mode 100644 index 0000000000..33e01f2224 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/515278-1.html @@ -0,0 +1,3 @@ +
+<fooz> +
diff --git a/parser/htmlparser/tests/crashtests/515533-1-inner.html b/parser/htmlparser/tests/crashtests/515533-1-inner.html new file mode 100644 index 0000000000..6bd0684e21 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/515533-1-inner.html @@ -0,0 +1,12 @@ +<html> +<head> +</head> +<body> +<!-- xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx --> +<!-- xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx --> +<!-- xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx --> +<script language="javascript"> +window.location.replace("data:text/plain,"); +</script> +</body> +</html> diff --git a/parser/htmlparser/tests/crashtests/515533-1.html b/parser/htmlparser/tests/crashtests/515533-1.html new file mode 100644 index 0000000000..b0d5b570b8 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/515533-1.html @@ -0,0 +1 @@ +<iframe src="515533-1-inner.html"></iframe> diff --git a/parser/htmlparser/tests/crashtests/515816-1.html b/parser/htmlparser/tests/crashtests/515816-1.html new file mode 100644 index 0000000000..c518d2a3cf --- /dev/null +++ b/parser/htmlparser/tests/crashtests/515816-1.html @@ -0,0 +1,11 @@ +<html>
+<body>
+<!-- xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -->
+<!-- xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -->
+<!-- xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -->
+<!-- xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -->
+<!-- xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -->
+<!-- xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -->
+<form>
+<input>
+<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
diff --git a/parser/htmlparser/tests/crashtests/522326-1.html b/parser/htmlparser/tests/crashtests/522326-1.html new file mode 100644 index 0000000000..d06ab6cf7d --- /dev/null +++ b/parser/htmlparser/tests/crashtests/522326-1.html @@ -0,0 +1 @@ +<html><head><META http-equiv="Content-Type" content="text/html; charset=utf-16"><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"></head><body>abcd</body></html> diff --git a/parser/htmlparser/tests/crashtests/525229-1.html b/parser/htmlparser/tests/crashtests/525229-1.html new file mode 100644 index 0000000000..8bffa7d601 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/525229-1.html @@ -0,0 +1,7 @@ +<!DOCTYPE html> +<title>Test for bug 525229</title> +<body> +<script> +document.write("<script src='data:text/javascript,'><\/script><div>"); +</script> +text diff --git a/parser/htmlparser/tests/crashtests/536097-1.html b/parser/htmlparser/tests/crashtests/536097-1.html new file mode 100644 index 0000000000..76befb3cc8 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/536097-1.html @@ -0,0 +1 @@ +<script>document.write("<iframe></iframe\n");</script><img> diff --git a/parser/htmlparser/tests/crashtests/555462-iframe.html b/parser/htmlparser/tests/crashtests/555462-iframe.html new file mode 100644 index 0000000000..3ddd6282db --- /dev/null +++ b/parser/htmlparser/tests/crashtests/555462-iframe.html @@ -0,0 +1,3 @@ +<!--mmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmm mmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmm mmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmm mmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmm mmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmm mmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmm --> +<textarea><mmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmm +</textarea>
\ No newline at end of file diff --git a/parser/htmlparser/tests/crashtests/555462.html b/parser/htmlparser/tests/crashtests/555462.html new file mode 100644 index 0000000000..f8d4afad71 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/555462.html @@ -0,0 +1,21 @@ +<!DOCTYPE HTML> +<html class="reftest-wait"><head> + <meta charset="utf-8"> + <title>Testcase for bug 555462</title> +<script> +function f1() { + window.frames[0].frameElement.removeAttribute("onload"); + window.frames[0].location.reload(); + setTimeout(f2,200); +} +function f2() { window.frames[0].location.reload(); setTimeout(done,400); } +function done() { document.documentElement.removeAttribute("class"); } +</script> +</head> +<body> + +<iframe src="555462-iframe.html" onload="setTimeout(f1,100)"></iframe> + + +</body> +</html> diff --git a/parser/htmlparser/tests/crashtests/563514-1.html b/parser/htmlparser/tests/crashtests/563514-1.html new file mode 100644 index 0000000000..b96ce14661 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/563514-1.html @@ -0,0 +1,10 @@ +<!DOCTYPE html> +<head> +<script> +function boom() +{ + document.createElement("span").innerHTML = "<body a='b'>"; +} +</script> +</head> +<body onload="boom();"></body>
\ No newline at end of file diff --git a/parser/htmlparser/tests/crashtests/574884-1.html b/parser/htmlparser/tests/crashtests/574884-1.html new file mode 100644 index 0000000000..19de3c74a4 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/574884-1.html @@ -0,0 +1 @@ +<svg></html> diff --git a/parser/htmlparser/tests/crashtests/574884-2.html b/parser/htmlparser/tests/crashtests/574884-2.html new file mode 100644 index 0000000000..09bec52e6d --- /dev/null +++ b/parser/htmlparser/tests/crashtests/574884-2.html @@ -0,0 +1 @@ +<math></html> diff --git a/parser/htmlparser/tests/crashtests/58455-1.html b/parser/htmlparser/tests/crashtests/58455-1.html new file mode 100644 index 0000000000..7c235f9806 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/58455-1.html @@ -0,0 +1,15 @@ +<html>
+<head>
+ <title>Computer Market Online</title>
+ <BASE HREF="http://www.computermarket.com.au/">
+</head>
+
+<body bgcolor="#ffffff">
+
+<table>
+<tr><td><a href='prodDetail.asp?id=6007&catid=241'>This shows</a></td></tr>
+<tr><td><a href='prodDetail.asp?id=6007&catid=241'">This does not show</a></td></tr>
+</table>
+
+</body>
+</html>
diff --git a/parser/htmlparser/tests/crashtests/591330-1.html b/parser/htmlparser/tests/crashtests/591330-1.html new file mode 100644 index 0000000000..31719fac6a --- /dev/null +++ b/parser/htmlparser/tests/crashtests/591330-1.html @@ -0,0 +1,284 @@ +<script> +var sleep = 500; // 0.5 seconds +var start = Number(new Date()); +while(Number(new Date()) - start < sleep) { +} +document.write("<div>"); // make speculation fail +</script> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> +<span> + diff --git a/parser/htmlparser/tests/crashtests/60110-1.html b/parser/htmlparser/tests/crashtests/60110-1.html new file mode 100644 index 0000000000..34f8c406b8 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/60110-1.html @@ -0,0 +1,22 @@ +<HTML><HEAD>
+<TITLE>Edit parameters</TITLE>
+
+
+</HEAD>
+<BODY BGCOLOR="#FFFFFF" TEXT="#000000"
+LINK="#0000EE" VLINK="#551A8B" ALINK="#FF0000" >
+ +<p>
+Any item you check Reset on will get reset to its default value.
+<form method=post action=doeditparams.cgi><table>
+ +<tr><td valign=top><input type=checkbox name=reset-newchangedmail>Reset</td><td>
+<textarea wrap=hard name=newchangedmail rows=10 cols=80>From: bugzilla-daemon
To: %to%
Cc: %cc%
Subject: [Bug %bugid%] %neworchanged% - %summary%

%urlbase%show_bug.cgi?id=%bugid%

%diffs%</textarea>
+</td></tr>
+<tr><td valign=top><input type=checkbox name=reset-whinemail>Reset</td><td>
+<textarea wrap=hard name=whinemail rows=10 cols=80>From: bugzilla-daemon
To: %email%
Subject: Your Bugzilla buglist needs attention.

[This e-mail has been automatically generated.]

You have one or more bugs assigned to you in the Bugzilla 
bugsystem (%urlbase%) that require
attention.

All of these bugs are in the NEW state, and have not been touched
in %whinedays% days or more. You need to take a look at them, and 
decide on an initial action.



</textarea>
+</td></tr>
+<tr><td></td><td>2.11</td></tr></table>
+<input type=reset value="Reset form"><br>
+<input type=submit value="Submit changes">
+</form>
\ No newline at end of file diff --git a/parser/htmlparser/tests/crashtests/616027-1.html b/parser/htmlparser/tests/crashtests/616027-1.html new file mode 100644 index 0000000000..d4707c9359 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/616027-1.html @@ -0,0 +1,15 @@ +<!DOCTYPE html> +<html> +<body> +<script> + + +for (var fuzzRepeat = 0; fuzzRepeat < 500; ++fuzzRepeat) { + document.write("<span>"); +} +document.write("<isindex>"); + + +</script> +</body> +</html> diff --git a/parser/htmlparser/tests/crashtests/650501-1.xhtml b/parser/htmlparser/tests/crashtests/650501-1.xhtml new file mode 100644 index 0000000000..c701a0c76c --- /dev/null +++ b/parser/htmlparser/tests/crashtests/650501-1.xhtml @@ -0,0 +1,22 @@ + +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script> +<![CDATA[ + +function boom() +{ + var a = document.createElement("div"); + a.innerHTML = "<script>1;<\/script>"; + + var b = document.createElement("div") + try { b.innerHTML = "<"; } catch (invalidXML) { } + + document.documentElement.appendChild(a); +} + +]]> +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/parser/htmlparser/tests/crashtests/662185-1.html b/parser/htmlparser/tests/crashtests/662185-1.html new file mode 100644 index 0000000000..41d67e5355 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/662185-1.html @@ -0,0 +1 @@ +<meta charset=t>
diff --git a/parser/htmlparser/tests/crashtests/696651-1.html b/parser/htmlparser/tests/crashtests/696651-1.html new file mode 100644 index 0000000000..8c5ee9ed3a --- /dev/null +++ b/parser/htmlparser/tests/crashtests/696651-1.html @@ -0,0 +1,11 @@ +<!DOCTYPE html> +<script> +function runTest() { + var iframe = document.getElementsByTagName("iframe")[0]; + var doc = iframe.contentDocument; + doc.write("\u003cscript>document.close();\u003c/script>foo"); +} +</script> +<body onload="runTest();"> +<iframe></iframe> + diff --git a/parser/htmlparser/tests/crashtests/699347-1.xml b/parser/htmlparser/tests/crashtests/699347-1.xml new file mode 100644 index 0000000000..c6dd4bfa1b --- /dev/null +++ b/parser/htmlparser/tests/crashtests/699347-1.xml @@ -0,0 +1 @@ +<?xml version="1.0"?><root/> diff --git a/parser/htmlparser/tests/crashtests/721313-1.html b/parser/htmlparser/tests/crashtests/721313-1.html new file mode 100644 index 0000000000..06497cd65b --- /dev/null +++ b/parser/htmlparser/tests/crashtests/721313-1.html @@ -0,0 +1,2 @@ +<!DOCTYPE html> +<script>(new DOMParser()).parseFromString("", "text/html");</script> diff --git a/parser/htmlparser/tests/crashtests/73331-1.html b/parser/htmlparser/tests/crashtests/73331-1.html new file mode 100644 index 0000000000..6761a6686a --- /dev/null +++ b/parser/htmlparser/tests/crashtests/73331-1.html @@ -0,0 +1,27 @@ +<html> +<head> +<script> +function crashme() { + var obj = document.getElementById('popupid'); + obj.style.visibility='hidden'; +} +</script> +</head> +<body onload="crashme();"> +<a href="http://www.mozilla.org/">http://www.mozilla.org/</a> + +<div id="popupid"> +<font> +<script> + document.write('<form>'); + document.write('<span>'); + document.write('<input>'); + document.write('</span>'); + document.write('<br>'); + document.write('</form>'); +</script> +</font> +</div> + +</body> +</html> diff --git a/parser/htmlparser/tests/crashtests/742414-1.html b/parser/htmlparser/tests/crashtests/742414-1.html new file mode 100644 index 0000000000..e35b125603 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/742414-1.html @@ -0,0 +1,4 @@ +<script></script +><script></script +><script></script +> diff --git a/parser/htmlparser/tests/crashtests/762726-1.html b/parser/htmlparser/tests/crashtests/762726-1.html new file mode 100644 index 0000000000..4692b73e1e --- /dev/null +++ b/parser/htmlparser/tests/crashtests/762726-1.html @@ -0,0 +1 @@ +<meta charset> diff --git a/parser/htmlparser/tests/crashtests/92647-1.html b/parser/htmlparser/tests/crashtests/92647-1.html new file mode 100644 index 0000000000..16be8d98e1 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/92647-1.html @@ -0,0 +1,33 @@ +<HTML>
+<BODY>
+ <form>
+<TABLE border="1">
+ <TR>
+ <TD>
+ <TABLE border="2">
+ <TR>
+ <TD WIDTH="30%">
+ Member Number:
+ </TD>
+ <TD WIDTH="70%">
+ <INPUT NAME="EchoUser" TYPE="TEXT">
+ </TD>
+ </TR>
+ <TR>
+ <TD>
+ PIN:
+ </TD>
+ <TD>
+ <INPUT TYPE="password">
+ </TD>
+ <TD>
+ </TD>
+ </TR>
+ </TABLE>
+ </TD>
+ </TR>
+</TABLE>
+</Form>
+</BODY>
+</HTML>
+
diff --git a/parser/htmlparser/tests/crashtests/92788-1.html b/parser/htmlparser/tests/crashtests/92788-1.html new file mode 100644 index 0000000000..955301e3f2 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/92788-1.html @@ -0,0 +1,20 @@ +<HTML><HEAD><TITLE>Bug #92788</TITLE></HEAD>
+<BODY>
+<TABLE>
+ <TR>
+ <TD>
+ <CENTER>
+ <TR>
+ <TD>
+ <IFRAME
+ marginWidth=0 marginHeight=0 src="foo" frameBorder=0 width=125 scrolling=no
+ height=125><SCRIPT LANGUAGE="JavaScript">document.write('<SCR'+'IPT LANGUAGE="JavaScript" SRC="http://ads1.ad-flow.com/?DC=tweak3d+-+rst&JS=Y&TARGET=_blank"></SCR'+'IPT>');</SCRIPT><NOSCRIPT><A HREF="http://ads1.ad-flow.com/?SHT=tweak3d+-+rst" TARGET="_blank"><IMG SRC="http://ads1.ad-flow.com/?SIT=tweak3d+-+rst" HEIGHT="125" WIDTH="125"></A></NOSCRIPT></IFRAME>-->
+ <FORM name=EmailSub onsubmit="if ( (document.EmailSub.email.length == 0) || (document.EmailSub.email.value.indexOf('@') == -1) || (document.EmailSub.email.value.indexOf('.') == -1) ) {('Invalid Email address');return false;} window.open('http://www.pluginnewsletter.com/nl-popsub.cfm?wsnum=369&' + 'Email=' + document.EmailSub.email.value,'WinOpen','toolbar=no,scrollbars=yes,resizable=yes,width=666,height=666'); return false;">
+ <SCRIPT language=JavaScript src="foo.js"></SCRIPT>
+ <NOSCRIPT><A target=_blank href="http://ads1.ad-flow.com/?SHT=tweak3d-lst" WIDTH="468" HEIGHT="60"><IMG src="Tweak3D_net - Your Freakin' Tweakin' Source!_fichiers/ads1.ad-flow.gif"></A>
+ </NOSCRIPT></CENTER>
+
+ <TR bgColor=#ffffff>
+ <CENTER><IFRAME marginWidth=0 marginHeight=0 src="foo" frameBorder=0 width=468 scrolling=no height=60><SCRIPT LANGUAGE="JavaScript">document.write('<SCR'+'IPT LANGUAGE="JavaScript" SRC="http://ads1.ad-flow.com/?DC=tweak3d-top&JS=Y&TARGET=_blank"></SCR'+'IPT>');</SCRIPT><NOSCRIPT><A HREF="http://ads1.ad-flow.com/?SHT=tweak3d-top" TARGET="_blank"><IMG SRC="http://ads1.ad-flow.com/?SIT=tweak3d-top&SC=Y" HEIGHT="60" WIDTH="468"></A></NOSCRIPT></IFRAME>
+</CENTER></TR>
+</BODY></HTML>
diff --git a/parser/htmlparser/tests/crashtests/981279-1.html b/parser/htmlparser/tests/crashtests/981279-1.html new file mode 100644 index 0000000000..5f14c8af37 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/981279-1.html @@ -0,0 +1,15 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset=utf-8> +</head> +<body> +<div></div> +<script> +var div = document.getElementsByTagName("div")[0]; +div.innerHTML = "<div À Á Â Ã Ä Å "; +div.innerHTML = "<div a>"; +</script> +</body> +</html> + diff --git a/parser/htmlparser/tests/crashtests/982285-1.html b/parser/htmlparser/tests/crashtests/982285-1.html new file mode 100644 index 0000000000..d3e124d957 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/982285-1.html @@ -0,0 +1,19 @@ +<q> +<u> +<pre> +<pre> +<center> +<em> +<center> +<center> +</rp> +<address> +<address> +<address> +</rt> +<q> +<q> +<rt> +</u> +<pre> +</em> diff --git a/parser/htmlparser/tests/crashtests/crashtests.list b/parser/htmlparser/tests/crashtests/crashtests.list new file mode 100644 index 0000000000..ed82176f37 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/crashtests.list @@ -0,0 +1,66 @@ +load 30885-1.html +load 30956-1.html +load 31392-1.html +load 31694-1.html +load 31940-1.html +load 32613-1.html +load 34168-1.html +load 34168-1.xml +load 41427-1.html +load 44178-1.html +load 46495-1.html +load 50134-1.html +load 50994-1.html +load 58455-1.html +load 60110-1.html +load 73331-1.html +load 92647-1.html +load 92788-1.html +load 121591-1.html +load 147179-1.html +load 151956-1.html +load 152444-1.html +load 185073-1.html +load 188474-1.html +load 194329-1.html +load 197052-1.html +load 220542-1.html +load 253979-1.html +load 269095-1.html +load 286733-1.html +load 286733-2.html +load 299036-1.html +skip-if(cocoaWidget&&browserIsRemote) load 328751-1.html # Bug 849747 +load 408939-1.html +load 423373-1.html +load 445171-1.html +load 468538-1.xhtml +load 502103.html +load 502869.html +load 515278-1.html +load 515533-1.html +load 515816-1.html +load 522326-1.html +load 525229-1.html +load 536097-1.html +load 555462.html +load 563514-1.html +load 574884-1.html +load 574884-2.html +load 591330-1.html +load 616027-1.html +load 650501-1.xhtml +load 662185-1.html +load 696651-1.html +load view-source:699347-1.xml +load 721313-1.html +load view-source:742414-1.html +load 762726-1.html +load 981279-1.html +load 982285-1.html +load 1373045-1.html +load 1534346-1.html +load 1604307-1.html +load 1606499-1.html +load 1547895-1.html +skip-if(Android) skip-if(isDebugBuild) load 1747514.html # Bug 1780219 diff --git a/parser/htmlparser/tests/crashtests/file_445171-1.html b/parser/htmlparser/tests/crashtests/file_445171-1.html new file mode 100644 index 0000000000..de8a5eb065 --- /dev/null +++ b/parser/htmlparser/tests/crashtests/file_445171-1.html @@ -0,0 +1 @@ +<script>parent.done()</script> |
