diff options
Diffstat (limited to 'testing/web-platform/tests/svg/crashtests')
13 files changed, 169 insertions, 0 deletions
diff --git a/testing/web-platform/tests/svg/crashtests/chrome-bug-1172059.html b/testing/web-platform/tests/svg/crashtests/chrome-bug-1172059.html new file mode 100644 index 0000000000..1c788ab3d8 --- /dev/null +++ b/testing/web-platform/tests/svg/crashtests/chrome-bug-1172059.html @@ -0,0 +1,3 @@ +<!doctype html> +<p>This test should not crash.</p> +<svg><use href="support/used.svg#svg-text"></use></svg> diff --git a/testing/web-platform/tests/svg/crashtests/chrome-bug-1205852.html b/testing/web-platform/tests/svg/crashtests/chrome-bug-1205852.html new file mode 100644 index 0000000000..2048b57bc0 --- /dev/null +++ b/testing/web-platform/tests/svg/crashtests/chrome-bug-1205852.html @@ -0,0 +1,13 @@ +<!DOCTYPE html> +<body style="position: relative;"> + <svg style="top: 0; left: 0; position:absolute;" width="10" height="10"> + <rect id="target" width="5" height="10" /> + </svg> + <div id="target2" style="position: absolute; width: 10px; height: 10px; top: 0; left: 0; background: lime;"></div> +</body> +<script> +document.body.offsetTop; +document.getElementById('target').setAttribute('width', '10'); +document.body.offsetTop; +document.getElementById('target2').style.transform = 'translate(2px, 2px)' +</script> diff --git a/testing/web-platform/tests/svg/crashtests/chrome-bug-1207590.html b/testing/web-platform/tests/svg/crashtests/chrome-bug-1207590.html new file mode 100644 index 0000000000..3cbf61f02f --- /dev/null +++ b/testing/web-platform/tests/svg/crashtests/chrome-bug-1207590.html @@ -0,0 +1,10 @@ +<!DOCTYPE html> +<style> +body, svg { + position: absolute; +} +</style> +<svg width="-1"></svg> +<svg width="-5"></svg> +<svg height="-1"></svg> +<svg height="-5"></svg> diff --git a/testing/web-platform/tests/svg/crashtests/chrome-bug-1238412.html b/testing/web-platform/tests/svg/crashtests/chrome-bug-1238412.html new file mode 100644 index 0000000000..93e12f6e13 --- /dev/null +++ b/testing/web-platform/tests/svg/crashtests/chrome-bug-1238412.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org"> +<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1238412"> +<div style="columns:2; column-fill:auto; height:60px;"> + <svg viewBox="0 0 480 360"> + <g> + <defs> + <path id="Red100" d="M 0 0 L 0 150 L 150 0 z"></path> + <filter id="xor" x="0" y="0" width="1" height="1"> + <feImage href="#Red100" result="red"></feImage> + </filter> + </defs> + <g> + <rect x="0" y="0" width="150" height="150" filter="url(#xor)"></rect> + </g> + </g> + </svg> +</div> diff --git a/testing/web-platform/tests/svg/crashtests/chrome-bug-1345806.html b/testing/web-platform/tests/svg/crashtests/chrome-bug-1345806.html new file mode 100644 index 0000000000..afe3029d00 --- /dev/null +++ b/testing/web-platform/tests/svg/crashtests/chrome-bug-1345806.html @@ -0,0 +1,6 @@ +<!doctype html> +<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1345806"> +<link rel="author" title="Philip Rogers" href="mailto:pdr@chromium.org"> +<svg> + <path pathLength='-0.0' d='M0 0 L 100 0 L 100 100 L 0 100Z' stroke-dasharray='58,119,146' stroke="green"/> +</svg>
\ No newline at end of file diff --git a/testing/web-platform/tests/svg/crashtests/chrome-bug-1371700.html b/testing/web-platform/tests/svg/crashtests/chrome-bug-1371700.html new file mode 100644 index 0000000000..e1a13305c4 --- /dev/null +++ b/testing/web-platform/tests/svg/crashtests/chrome-bug-1371700.html @@ -0,0 +1,10 @@ +<!doctype html> +<p>This test should not crash.</p> +<svg id="svgvar00001"> + <clipPath> + <image xlink:href="#nothing" onerror="foo()"/> + </clipPath> +</svg> +<svg> + <use xlink:href="#svgvar00001"/> +</svg> diff --git a/testing/web-platform/tests/svg/crashtests/firefox-bug-1688293.html b/testing/web-platform/tests/svg/crashtests/firefox-bug-1688293.html new file mode 100644 index 0000000000..9ab1a88312 --- /dev/null +++ b/testing/web-platform/tests/svg/crashtests/firefox-bug-1688293.html @@ -0,0 +1,25 @@ +<!DOCTYPE html> +<script> + window.addEventListener('load', () => { + const svg = document.createElementNS('http://www.w3.org/2000/svg', 'svg') + const clip = document.createElementNS('http://www.w3.org/2000/svg', 'clipPath') + const use = document.createElementNS('http://www.w3.org/2000/svg', 'use') + const style = document.createElementNS('http://www.w3.org/2000/svg', 'style') + document.documentElement.appendChild(svg) + svg.setAttribute('id', 'id_0') + clip.appendChild(use) + svg.appendChild(clip) + document.documentElement.appendChild(style) + style.textContent = ` + @import url(dom--23104-J7UdNQ5SQ5Rv-.css); + @namespace url(http://www.w3.org/1999/xhtml); + @namespace svg url(http://www.w3.org/2000/svg); + * { + filter: url(#id_0); + } + svg|* { + transition: 352ms ! important; + y: 29%; + }` + }) +</script> diff --git a/testing/web-platform/tests/svg/crashtests/firefox-bug-1703592.html b/testing/web-platform/tests/svg/crashtests/firefox-bug-1703592.html new file mode 100644 index 0000000000..badd12e5dd --- /dev/null +++ b/testing/web-platform/tests/svg/crashtests/firefox-bug-1703592.html @@ -0,0 +1,20 @@ +<!DOCTYPE html> +<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1703592"> +<style> +* { + font-size: 1237818528.6247747em; +} +</style> +<script> + window.addEventListener('load', async () => { + const svg_1 = document.createElementNS('http://www.w3.org/2000/svg', 'svg') + const svg_2 = document.createElementNS('http://www.w3.org/2000/svg', 'svg') + const anchor = document.createElementNS('http://www.w3.org/2000/svg', 'a') + svg_2.setAttribute('width', '14em') + anchor.appendChild(svg_2) + svg_1.appendChild(anchor) + document.documentElement.appendChild(svg_1) + const selection = window.getSelection() + selection.selectAllChildren(svg_1) + }) +</script> diff --git a/testing/web-platform/tests/svg/crashtests/firefox-bug-1719483.html b/testing/web-platform/tests/svg/crashtests/firefox-bug-1719483.html new file mode 100644 index 0000000000..f22903388d --- /dev/null +++ b/testing/web-platform/tests/svg/crashtests/firefox-bug-1719483.html @@ -0,0 +1,20 @@ +<!DOCTYPE html> +<style> + * { + padding: 2880804336.4242716vmax 854269137% 347744005.57952744in 2487922492.561039pt; + } +</style> +<script> + const button = document.createElement("button") + const select = document.createElement("select") + const optgroup = document.createElement("optgroup") + const option = document.createElement("option") + button.setAttribute("id", "button_0") + optgroup.appendChild(option) + select.appendChild(optgroup) + button.appendChild(select) + document.documentElement.appendChild(button) + const canvas = document.createElement("canvas") + const context = canvas.getContext("2d", { "willReadFrequently": false, "alpha": true }) + context.filter = "url(#button_0)" +</script> diff --git a/testing/web-platform/tests/svg/crashtests/firefox-bug-1723249.html b/testing/web-platform/tests/svg/crashtests/firefox-bug-1723249.html new file mode 100644 index 0000000000..bd863cba88 --- /dev/null +++ b/testing/web-platform/tests/svg/crashtests/firefox-bug-1723249.html @@ -0,0 +1,16 @@ +<!DOCTYPE html> +<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1723249"> +<style> +#a { + mask-image: url(#c); +} +</style> +<script> +window.onload = () => { + c.innerHTML = b.outerHTML +} +</script> +<pre id="a">x</pre> +<svg id="b"> +<mask id="c" /> +<image requiredExtensions="x"> diff --git a/testing/web-platform/tests/svg/crashtests/firefox-bug-1724237.html b/testing/web-platform/tests/svg/crashtests/firefox-bug-1724237.html new file mode 100644 index 0000000000..8d8fd9c44f --- /dev/null +++ b/testing/web-platform/tests/svg/crashtests/firefox-bug-1724237.html @@ -0,0 +1,11 @@ +<!DOCTYPE html> +<link rel=help href="https://bugzilla.mozilla.org/show_bug.cgi?id=1724237"> +<svg> + <animateTransform id="id_0"></animateTransform> + <rect id="id_1"></rect> +</svg> +<script> + new IntersectionObserver((e1, e2) => { + e2.observe(document.getElementById("id_1")) + }).observe(document.getElementById("id_0")) +</script> diff --git a/testing/web-platform/tests/svg/crashtests/firefox-bug-1753105.html b/testing/web-platform/tests/svg/crashtests/firefox-bug-1753105.html new file mode 100644 index 0000000000..3105c577be --- /dev/null +++ b/testing/web-platform/tests/svg/crashtests/firefox-bug-1753105.html @@ -0,0 +1,14 @@ +<!DOCTYPE html> +<script> + document.addEventListener("DOMContentLoaded", () => { + const svg = document.createElementNS("http://www.w3.org/2000/svg", "svg") + const text = document.createElementNS("http://www.w3.org/2000/svg", "text") + text.setAttribute("letter-spacing", "-37vw") + const node = document.createTextNode("\n\n\r7%٠\0ó …§ð†ªã€€&**=🯚ð¯‚ï¸¡ó ”©Û¹â€Ùªv*/ð¯„𖹧åžçº¶*;{0ð–£”9̆뢻\r\n^掶𩹺*|\r\n🩂٫ð‡½ë«»e犮㇆á²ð¡‡‚\u2028ᨲâ¤\rv+🧌8שּׁ\nð¯Žè›¥ó „ˆêº¡\nâ’ð±’٠۹𖯸0ó ¤™/ᾂ𫞾99 a&=ð‰‚۹𯩒゙2ó ¥µ^0ê’‹ð—»ð…»\0X%+0*/镳　٪ȺXá©¿L2⼤𛪈Âðª¸ð›‰") + text.appendChild(node) + svg.appendChild(text) + document.documentElement.appendChild(svg) + const rect = document.documentElement.getBoundingClientRect() + node.convertRectFromNode(rect, svg, {}) + }) +</script> diff --git a/testing/web-platform/tests/svg/crashtests/support/used.svg b/testing/web-platform/tests/svg/crashtests/support/used.svg new file mode 100644 index 0000000000..37ce3f5762 --- /dev/null +++ b/testing/web-platform/tests/svg/crashtests/support/used.svg @@ -0,0 +1,3 @@ +<svg version="1.1" xmlns="http://www.w3.org/2000/svg"> + <text id="svg-text" x="0" y="20" style="font-family: sans-serif">Text</text> +</svg> |
