diff options
Diffstat (limited to 'dom/media/tests/crashtests')
40 files changed, 873 insertions, 0 deletions
diff --git a/dom/media/tests/crashtests/1281695.html b/dom/media/tests/crashtests/1281695.html new file mode 100644 index 0000000000..9865c3a509 --- /dev/null +++ b/dom/media/tests/crashtests/1281695.html @@ -0,0 +1,24 @@ + +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> + +function zombieWindow() +{ + var frame = document.createElement("iframe"); + document.body.appendChild(frame); + var frameWin = frame.contentWindow; + frame.remove(); + return frameWin; +} + +function boom() { + zombieWindow().navigator.mozGetUserMedia({ "fake": true, "audio": true }, function(stream) {}, function(e) {}); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/media/tests/crashtests/1306476.html b/dom/media/tests/crashtests/1306476.html new file mode 100644 index 0000000000..d15cbe57df --- /dev/null +++ b/dom/media/tests/crashtests/1306476.html @@ -0,0 +1,47 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<head> + <meta charset=utf-8> + <title>Bug 1348381: Integer overflow playing vorbis file</title> +</head> +<body> + <audio id=player controls + src="data:audio/ogg;base64,T2dnUwACAAAAAAAAAAD+ML0RAAAAACtaCMoBHgF2b3JiaXMAAAAAAkSsAAAAAAAAAHECAAAAAAC4AU9nZ1MAAAAAAAAAAAAA/jC9EQEAAACZyDL8E/8a/////////////////////5EDdm9yYmlzLQAAAFhpcGguT3JnIGxpYlZvcmJpcyBJIDIwMTAxMTAxIChTY2hhdWZlbnVnZ2V0KRAAAAAbAAAARU5DT0RFUj1Ib29rRmxhc2hPZ2dFbmNvZGVyBwAAAFRJVExFPWYIAAAAVkVSU0lPTj0HAAAAQUxCVU09YQwAAABUUkFDS05VTUJFUj0IAAAAQVJUSVNUPWEKAAAAUEVSRk9STUVSPQoAAABDT1BZUklHSFQ9CAAAAExJQ0VOU0U9DQAAAE9SR0FOSVpBVElPTj0MAAAAREVTQ1JJUFRJT049BgAAAEdFTlJFPQUAAABEQVRFPQoAAABMT0NBVElPTj1mCAAAAENPTlRBQ1Q9BQAAAElTUkM9AQV2b3JiaXMpQkNWAQAIAAAAMUwgxYDQkFUAABAAAGAkKQ6TZkkppZShKHmYlEhJKaWUxTCJmJSJxRhjjDHGGGOMMcYYY4wgNGQVAAAEAIAoCY6j5klqzjlnGCeOcqA5aU44pyAHilHgOQnC9SZjbqa0pmtuziklCA1ZBQAAAgBASCGFFFJIIYUUYoghhhhiiCGHHHLIIaeccgoqqKCCCjLIIINMMumkk0466aijjjrqKLTQQgsttNJKTDHVVmOuvQZdfHPOOeecc84555xzzglCQ1YBACAAAARCBhlkEEIIIYUUUogppphyCjLIgNCQVQAAIACAAAAAAEeRFEmxFMuxHM3RJE/yLFETNdEzRVNUTVVVVVV1XVd2Zdd2ddd2fVmYhVu4fVm4hVvYhV33hWEYhmEYhmEYhmH4fd/3fd/3fSA0ZBUAIAEAoCM5luMpoiIaouI5ogOEhqwCAGQAAAQAIAmSIimSo0mmZmquaZu2aKu2bcuyLMuyDISGrAIAAAEABAAAAAAAoGmapmmapmmapmmapmmapmmapmmaZlmWZVmWZVmWZVmWZVmWZVmWZVmWZVmWZVmWZVmWZVmWZVmWZVlAaMgqAEACAEDHcRzHcSRFUiTHciwHCA1ZBQDIAAAIAEBSLMVyNEdzNMdzPMdzPEd0RMmUTM30TA8IDVkFAAACAAgAAAAAAEAxHMVxHMnRJE9SLdNyNVdzPddzTdd1XVdVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVgdCQVQAABAAAIZ1mlmqACDOQYSA0ZBUAgAAAABihCEMMCA1ZBQAABAAAiKHkIJrQmvPNOQ6a5aCpFJvTwYlUmye5qZibc84555xszhnjnHPOKcqZxaCZ0JpzzkkMmqWgmdCac855EpsHranSmnPOGeecDsYZYZxzzmnSmgep2Vibc85Z0JrmqLkUm3POiZSbJ7W5VJtzzjnnnHPOOeecc86pXpzOwTnhnHPOidqba7kJXZxzzvlknO7NCeGcc84555xzzjnnnHPOCUJDVgEAQAAABGHYGMadgiB9jgZiFCGmIZMedI8Ok6AxyCmkHo2ORkqpg1BSGSeldILQkFUAACAAAIQQUkghhRRSSCGFFFJIIYYYYoghp5xyCiqopJKKKsoos8wyyyyzzDLLrMPOOuuwwxBDDDG00kosNdVWY4215p5zrjlIa6W11lorpZRSSimlIDRkFQAAAgBAIGSQQQYZhRRSSCGGmHLKKaegggoIDVkFAAACAAgAAADwJM8RHdERHdERHdERHdERHc/xHFESJVESJdEyLVMzPVVUVVd2bVmXddu3hV3Ydd/Xfd/XjV8XhmVZlmVZlmVZlmVZlmVZlmUJQkNWAQAgAAAAQgghhBRSSCGFlGKMMcecg05CCYHQkFUAACAAgAAAAABHcRTHkRzJkSRLsiRN0izN8jRP8zTRE0VRNE1TFV3RFXXTFmVTNl3TNWXTVWXVdmXZtmVbt31Ztn3f933f933f933f933f13UgNGQVACABAKAjOZIiKZIiOY7jSJIEhIasAgBkAAAEAKAojuI4jiNJkiRZkiZ5lmeJmqmZnumpogqEhqwCAAABAAQAAAAAAKBoiqeYiqeIiueIjiiJlmmJmqq5omzKruu6ruu6ruu6ruu6ruu6ruu6ruu6ruu6ruu6ruu6ruu6ruu6QGjIKgBAAgBAR3IkR3IkRVIkRXIkBwgNWQUAyAAACADAMRxDUiTHsixN8zRP8zTREz3RMz1VdEUXCA1ZBQAAAgAIAAAAAADAkAxLsRzN0SRRUi3VUjXVUi1VVD1VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVXVNE3TNIHQkJUAABkAAOSkptR6DhJikDmJQWgIScQcxVw66ZyjXIyHkCNGSe0hU8wQBLWY0EmFFNTiWmodc1SLja1kSEEttsZSIeWoB0JDVkgAoRkADscBHE0DHEsDAAAAAAAAAEnTAE0UAc0TAQAAAAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcTQM0UQQ0UQQAAAAAAAAATRQB0VQB0TQBAAAAAAAAQBNFwDNFQDRVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcTQM0UQQ0UQQAAAAAAAAATRQBUTUBTzQBAAAAAAAAQBNFQDRNQFRNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAQ4AAAEWAYBaI2otWqMI4g+rV6R7YgzqBxzxPAoABKTZEc+jAEBAmt2aSlEkyDAZGaQAgEFQIwaNQYHcmv76xvuJ/wcax99/AZ0zMGTpUOBZywoG1CwdCjxrWcGA2ivJIydPYICNva3a22KANVRNW9VawWpYtxlBRKNoRFVtNAKK5l6EntQkF4KWe9GICIjE7u/fPwAsVsspu90EAtJ4sVpO2e0mEJDGfX0mCCtIRgqw2hs2thgWRRGrKhqNYFW1jUaHBnPzR9KhA62qaKTt0lorCvByEqsGFE13b7a3valOVDo93C5l45chA5VOD7dL2fhlyEC/1WMjJ9eSARsbq8Via9qoIBpVURUUrUVVxBYtoNGoYAWLVrFY8Vdr7cS7k6tkh06NVjG490Uuwwm6F8zQER+blAUoo9sLZuiIj03KApTRfQMAtHPTtHN3cGAHYgdiBwcWE2NmYiYWI5lYzEFMDACRjQwCaqidHXY2hmKqrR2U8AUEBSUJkaSUCHIYSys22qCqhloxDQyrVqxbmBZqWBqmIGphGsRtI0Rid3VfV1mXJ7JPVmu9q+7GrVvfm2kjUrY7ROptTtm3tbe3HDIuHVSouNbv6+rbp6rrSZpzeR3XrX3lHI6yvM05oizLXFIfVKGp2n3YOmsdLnnhlQYmR75CTGb/jfhdnW3YNpAEAnXJwma/fsLhWuQmJvPYpIDNr7Co8CT3E5BKNFIVNEd7zvzb7YSz4MjkbesITFOkm31cmuzakWtRemIWJS4kmEAHvAG2VRzkR8jjgIBJbt4qDvIj5HFAwCQ3fwMAWKGd6fRUDg4ODg6pxFI5iDExKcYksSNmBwdiEgASSpKBrdWwEau9YWcx7Q3TTsGKSPH5lCPJ8PgMR0JQLU3rat2wboGhNphWoTWf9Uaj6hBrbQVUBOrrbsjiTkhNgifk3KokPYYuda3NCanhbynzmtIIPvousqsQ3I7srnSltNMWcUXVGKNYQVEFVSyU0IbUMDVfty1hxIhYg2AUayfSnyRlSTpCi1u2fUpfwGocsAO2am7iqeSMLE8qAl5YxGXkHk+3u3mE9RpnU8AdgBquBRx95LgFW0EstsYWV8aAAyhgfWTLOmQTu6OyNnW11KZoGZcEsHG4CgDE5fQGGEJ0oN40Lqc3wBCiA/WmybF9yMkxJkPAME1Vi4X4ikjOzy5yRq/WfQvko9IVCh048w4AlOlKMhDQELEEKNOVZCCgIWIJcNVkIYIgOTnGCKgxCqpWtSCqLB2fIKBYWwZTR0M34MzSw9YrJVoyXOnKkickETWIkRrFK11Z8oQkogYxUqN4QJ0KpUQuiDEZAkZVjDX2rpD0JPOmpxC0omAB2d7qRMVSYej7AJTtyiroUp8glO3KKuhSnyAcUNaURUQgJyeDgREwqLWoStY5HWlFLaug6o9Exyo2b0PvdWCrAHTtSqvyTCiaI7qaQl270qo8E4rmiK6m0AE1WS8COQwYGCOgYAF7SRItrmUL2rZPTRXKE5zrsNeW9JACpO08WWIQtWJT0naeLDGIWrEpydHvAQsDY4yAvY1hY9oYhmpTOUO10Yh4s+9OnOSTJ5v2dla8BqztNGvcm+D/TcPaTrPGvQn+3zRcdQtkCjYyckENwFhrjYhRVVVFK5quP5Wq1WmwFjBVrdpoQRDRXinN2XCfailzkQAAAIA2GtsAfPH0ymO3Z9ZiKfl+8fTKY7dn1mIp+SbH9FhCM3JYDQArdqatYavebdaKKqpYVFsDtsagik7qkrZmHVRE8sUrdREWnZ++xFoUsTUiIAAaRrTRzkF+YE6h4g8j2mjnID8wp1Dxf1BUsqjNora2rKemUq0bAWQUWeQZCanEHBwcOYg5iDk4iDEzMzMzsRgzADHGYlStClhEsIKqgrUWjMUwTbUTw2pvYwOGqShaRdWKjUa1qOgARdEaUQHVJBMLvvTOJ+/iYffofiUvXXGB5E0fLYMk4ZcnUZZR5kxNIBbQAmLBpCs72845IOcSMkVL/QaXNCBl9LpOnlT5JC5nvBkkSssEp3Ehr3ZSazaRS+cYVDsW0fUf/VH35/UEhg9aWD+sBV0flgh2QEo+O1zCGwwcXn0EmCbfDax9dK9WJr11d6thwEHWcIdYQwGhIE8BAU9nZ1MABACAAAAAAAAA/jC9EQQAAAAyphcAAv8I3mSkYBs5OFY2oMlIwTZycKxswL45pIhNBxZzEGMxB3YQI2BmJmYGACBqYdWadSuWYmGzLayatrClhVgailpYt8lma5ZqxUabbLbBuoWa1my2wVLENFSNVmNEVVSxWLFct2XOfHVfrXFrMVjRalRE1WgVVbZu3Zp3J/Wusrl16wcxiMViwYqq0SoWEIsFLJZaa5V8m/Otq6y6zc395/XWD7XedddtNueOqTWucncSeRWAnL1vgRP2C2Dza03kzL5OcmmSqULlslzl7iqsc0c/y2ZmtVauklUysipXSa3rN2Q2OSE3S26wfm/IPfeEzE3n5vszm3vI/QJwkk29k8w="> + </audio> + <div id=result> + </div> + + <script type="application/javascript"> + function done() { + // Remove reftest-wait to terminate the test. + document.documentElement.removeAttribute("class"); + } + + function log(msg) { + // Append a status result. + let p = document.createElement("p"); + p.textContent = msg; + document.getElementById("result").appendChild(p); + } + + // Confirm playback completes. + let a = document.getElementById("player"); + a.addEventListener("ended", () => { + log("Playback completed."); + done(); + }); + a.addEventListener("error", () => { + log("Playback error."); + }); + + log("Starting playback..."); + a.play(); + + // Set a short timeout in case we hang. + setTimeout(() => { + log("Timed out!"); + done(); + }, 100); + </script> +</body> +</html> diff --git a/dom/media/tests/crashtests/1348381.html b/dom/media/tests/crashtests/1348381.html new file mode 100644 index 0000000000..b872e58794 --- /dev/null +++ b/dom/media/tests/crashtests/1348381.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<head> + <title>Bug 1348381: Crash when recording extremely large canvas' captureStream</title> +</head> +</body> +<canvas id="c" height="0.6"></canvas> +<img id="img" src="data:image/gif;base64,R0lGODlhAQABAAAAACwAAAAAAQABAAA="></img> +<script type="application/javascript"> +const c = document.getElementById("c"); +const ctx = c.getContext('2d'); +const s = c.captureStream(0); +const mr = new MediaRecorder(s); +const t = s.getVideoTracks()[0]; +mr.start(); +const img = document.getElementById('img'); +t.enabled = false; +ctx.drawImage(img, 16, 18014398509481984); +setTimeout(() => document.documentElement.removeAttribute("class"), 100); +</script> +</body> +</html> diff --git a/dom/media/tests/crashtests/1429507_1.html b/dom/media/tests/crashtests/1429507_1.html new file mode 100644 index 0000000000..894abf911a --- /dev/null +++ b/dom/media/tests/crashtests/1429507_1.html @@ -0,0 +1,13 @@ +<html> + <body> + <script> + try { o1 = window.open("") } catch (e) {} + try { o1.location.reload() } catch (e) {} + try { o2 = new RTCPeerConnection({iceServers: [{"url": "stun:d"}]}) } catch (e) {} + try { o1.navigator.mediaDevices.getUserMedia({video: true, fake: true}).catch((error) => {}) } catch (e) {} + try { o2.createOffer({offerToReceiveVideo: true}).then((offer) => { + try { o1.navigator.mediaDevices.getUserMedia({video: true}) } catch (e) {}; + }) } catch (e) {} + </script> + </body> +</html> diff --git a/dom/media/tests/crashtests/1429507_2.html b/dom/media/tests/crashtests/1429507_2.html new file mode 100644 index 0000000000..d5f15b648e --- /dev/null +++ b/dom/media/tests/crashtests/1429507_2.html @@ -0,0 +1,15 @@ +<html> + <body> + <script> + try { o1 = window.open("") } catch(e) { } + try { o1.location.reload() } catch(e) { } + try { o2 = o1.navigator } catch(e) { } + try { o3 = o2.mediaDevices } catch(e) { } + try { o4 = new XMLHttpRequest() } catch(e) { } + try { o3.getUserMedia({video: true, fake: true }).then((stream) => {}).catch((error) => {}) } catch (e) {} + try { o4.open("T", "aa", false) } catch(e) { } + try { o4.send() } catch(e) { } + try { o3.getUserMedia({video: true}).then((stream) => {}).catch((error) => {}) } catch (e) {} + </script> + </body> +</html> diff --git a/dom/media/tests/crashtests/1443212.html b/dom/media/tests/crashtests/1443212.html new file mode 100644 index 0000000000..3f0eedac90 --- /dev/null +++ b/dom/media/tests/crashtests/1443212.html @@ -0,0 +1,13 @@ +<script> +window.addEventListener("load", () => { + const c = document.createElement("canvas"); + c.getContext("2d"); + const stream = c.captureStream(); + const [track] = stream.getTracks(); + stream.removeTrack(track); + track.stop(); + stream.addTrack(track); + stream.removeTrack(track); + stream.addTrack(track); +}); +</script> diff --git a/dom/media/tests/crashtests/1453030.html b/dom/media/tests/crashtests/1453030.html new file mode 100644 index 0000000000..9452ec1205 --- /dev/null +++ b/dom/media/tests/crashtests/1453030.html @@ -0,0 +1,19 @@ +<html class="reftest-wait"> + <head> + <script> + function getDTMF () { + try { o4 = o2.dtmf } catch(e) { } + try { o4.insertDTMF("1BC1D55", new Uint32Array([3538134876])[0], new Uint32Array([666182017])[0]) } catch (e) { } + document.documentElement.removeAttribute("class"); + } + + o1 = new RTCPeerConnection({ }, null) + window.navigator.mediaDevices.getUserMedia({video: true, fake: true}).then((stream) => { + o2 = o1.addTrack(stream.getVideoTracks()[0], stream) + }).catch((error) => {}) + o3 = window.open("datr=0") + setTimeout(getDTMF, 400) + setTimeout(window.location.reload.bind(window.location), 500); + </script> + </head> +</html> diff --git a/dom/media/tests/crashtests/1468451.html b/dom/media/tests/crashtests/1468451.html new file mode 100644 index 0000000000..40f2efac0d --- /dev/null +++ b/dom/media/tests/crashtests/1468451.html @@ -0,0 +1,10 @@ +<script> +alice = new RTCPeerConnection({ iceServers: [{ 'url': 'stun:2' }], }, null) +bob = new RTCPeerConnection({ }, null) +alice.createOffer({ offerToReceiveAudio: true }) +track = alice.getReceivers()[0].track +alice.createOffer({ }).then((offer) => { + bob.addEventListener('signalingstatechange', (x) => x.target.addTransceiver(track, {}), { }) + bob.close() +}) +</script> diff --git a/dom/media/tests/crashtests/1490700.html b/dom/media/tests/crashtests/1490700.html new file mode 100644 index 0000000000..ea881c3096 --- /dev/null +++ b/dom/media/tests/crashtests/1490700.html @@ -0,0 +1,28 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<head> + <title>Bug 1490700 - Divide-by-zero for screen-capture with max-dimension 0</title> +</head> +</body> +<script type="application/javascript"> +async function test() { + SpecialPowers.wrap(document).notifyUserGestureActivation(); + await window.navigator.mediaDevices.getUserMedia({ + video: { + mediaSource: 'screen', + height: {max: 0}, + }, + }); + await window.navigator.mediaDevices.getUserMedia({ + video: { + mediaSource: 'screen', + advanced: [{height: 0}], + }, + }); + document.documentElement.removeAttribute("class"); +} + +test(); +</script> +</body> +</html> diff --git a/dom/media/tests/crashtests/1505957.html b/dom/media/tests/crashtests/1505957.html new file mode 100644 index 0000000000..7b0780a9cf --- /dev/null +++ b/dom/media/tests/crashtests/1505957.html @@ -0,0 +1,23 @@ +<html id='a'>
+<script>
+window.onload=function() {
+ b.src=document.getElementById('c').innerHTML;
+ b.setAttribute('src', 'video-crash.webm');
+ document.documentElement.style.display='none';
+ window.top.open('');
+ var o = window.frames[0].document.body.childNodes[0];
+ document.getElementById('d').appendChild(o.parentNode.removeChild(o));
+ o = document.getElementById('a');
+ var p = o.parentNode;
+ o.setAttribute('id', 0)
+ p.removeChild(o);
+ p.appendChild(o);
+ o.setAttribute('style', 0)
+ p.removeChild(o);
+ p.appendChild(o);
+}
+</script>
+<iframe id='b'></iframe>
+<object id='c'>
+<ruby id='d'>
+</html>
diff --git a/dom/media/tests/crashtests/1509442-1.html b/dom/media/tests/crashtests/1509442-1.html new file mode 100644 index 0000000000..eef877ecf8 --- /dev/null +++ b/dom/media/tests/crashtests/1509442-1.html @@ -0,0 +1,14 @@ +<!DOCTYPE HTML> +<meta charset="UTF-8"> +<script> + function start() { + o5=new AudioContext(); + o291=new Float32Array(0); + o388=document.write(""); + o389=o5.createBuffer(2,22050,44100); + o420=new AudioBufferSourceNode(o5, {buffer:o389,detune:27}); + o389.copyToChannel(o291,1,0); + document.close(); + } +</script> +<body onload="start()"></body> diff --git a/dom/media/tests/crashtests/1509442.html b/dom/media/tests/crashtests/1509442.html new file mode 100644 index 0000000000..ddce401933 --- /dev/null +++ b/dom/media/tests/crashtests/1509442.html @@ -0,0 +1,7 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<meta charset="UTF-8"> +<body> +<iframe src="1509442-1.html" onload="document.documentElement.removeAttribute('class')"></iframe> +</body> +</html> diff --git a/dom/media/tests/crashtests/1510848.html b/dom/media/tests/crashtests/1510848.html new file mode 100644 index 0000000000..05e2c2d852 --- /dev/null +++ b/dom/media/tests/crashtests/1510848.html @@ -0,0 +1,4 @@ +<a>
+<dd>
+<video>
+<a>
diff --git a/dom/media/tests/crashtests/1511130.html b/dom/media/tests/crashtests/1511130.html new file mode 100644 index 0000000000..6bdebe8de1 --- /dev/null +++ b/dom/media/tests/crashtests/1511130.html @@ -0,0 +1,12 @@ +<script>
+document.addEventListener("DOMContentLoaded", function(){
+ var o = window.frames[0].document.body.childNodes[0];
+ a.appendChild(o.parentNode.removeChild(o));
+ o = document.body;
+ o.parentNode.appendChild(o);
+ o.parentNode.appendChild(o);
+})
+</script>
+<body text=''>
+<hgroup id='a'>
+<iframe src="video-crash.webm"></iframe>
diff --git a/dom/media/tests/crashtests/1516292.html b/dom/media/tests/crashtests/1516292.html new file mode 100644 index 0000000000..93c844c939 --- /dev/null +++ b/dom/media/tests/crashtests/1516292.html @@ -0,0 +1,16 @@ +<script> +function go() { + a.children[0].appendChild(b) +} +</script> +<body onload=go()> +<svg id="a"> +<foreignObject> +<li> +<video controls="" autoplay=""> +<li id="a" contenteditable="true"> +</li> +</svg> +<canvas id="b"> +<svg> +<use xlink:href="#a"> diff --git a/dom/media/tests/crashtests/1573536.html b/dom/media/tests/crashtests/1573536.html new file mode 100644 index 0000000000..1283183254 --- /dev/null +++ b/dom/media/tests/crashtests/1573536.html @@ -0,0 +1,18 @@ +<html class="reftest-wait"> +<head> + <script> + function start () { + window.navigator.mediaDevices.getUserMedia({ + 'audio': { + 'mediaSource': 'audioCapture' + }, + 'video': true, + 'fake': true + }).catch(() => Promise.resolve()) + .then(() => document.documentElement.removeAttribute("class")) + } + + window.addEventListener('load', start) + </script> +</head> +</html> diff --git a/dom/media/tests/crashtests/1576938.html b/dom/media/tests/crashtests/1576938.html new file mode 100644 index 0000000000..71a785e299 --- /dev/null +++ b/dom/media/tests/crashtests/1576938.html @@ -0,0 +1,16 @@ +<html class="reftest-wait"> +<head> +<script> +async function start () { + const peer = new RTCPeerConnection() + await peer.createOffer({'offerToReceiveVideo': true}) + const receiver = peer.getReceivers()[0] + peer.close() + receiver.track.clone() + document.documentElement.removeAttribute("class") +} + +document.addEventListener('DOMContentLoaded', start) +</script> +</head> +</html> diff --git a/dom/media/tests/crashtests/1594136.html b/dom/media/tests/crashtests/1594136.html new file mode 100644 index 0000000000..7f3189257e --- /dev/null +++ b/dom/media/tests/crashtests/1594136.html @@ -0,0 +1,15 @@ +<html> +<head> +<script> +function start () { + const context = new AudioContext(); + const {stream} = new MediaStreamAudioDestinationNode(context); + const [track] = stream.getTracks(); + track.stop(); + context.createMediaStreamTrackSource(track); +} + +document.addEventListener('DOMContentLoaded', start); +</script> +</head> +</html> diff --git a/dom/media/tests/crashtests/1749308.html b/dom/media/tests/crashtests/1749308.html new file mode 100644 index 0000000000..1c17c6e35c --- /dev/null +++ b/dom/media/tests/crashtests/1749308.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html> +<head> + <script> + window.addEventListener("load", () => { + const context = new AudioContext({}) + const controller = new AbortController() + let processor = context.createScriptProcessor(512, 27, 2) + processor.addEventListener("audioprocess", async () => {}, { signal: controller.signal }) + processor = null; + SpecialPowers.forceGC() + for (let i = 0; i < 7; i++) { + controller.abort(); + } + }) + </script> +</head> +</html> diff --git a/dom/media/tests/crashtests/1764915.html b/dom/media/tests/crashtests/1764915.html new file mode 100644 index 0000000000..82534caac7 --- /dev/null +++ b/dom/media/tests/crashtests/1764915.html @@ -0,0 +1,14 @@ +<html> +<head> +<script> +window.addEventListener('load', async () => { + const frame = document.createElement('frame') + document.documentElement.appendChild(frame) + const peer = new RTCPeerConnection() + await peer.setRemoteDescription({}, () => {}, async () => await peer.getIdentityAssertion()) + peer.close() +}) +</script> +</head> +</html> + diff --git a/dom/media/tests/crashtests/1764933.html b/dom/media/tests/crashtests/1764933.html new file mode 100644 index 0000000000..55f6fa2db9 --- /dev/null +++ b/dom/media/tests/crashtests/1764933.html @@ -0,0 +1,15 @@ +<html> +<head> + <script> + window.addEventListener('load', async () => { + const peer = new RTCPeerConnection({}) + await peer.createOffer({ 'offerToReceiveVideo': true }) + const receivers = peer.getReceivers() + const sender = peer.addTrack(receivers[0].track) + peer.close() + await sender.getStats() + await sender.replaceTrack(receivers[0].track) + }) + </script> +</head> +</html> diff --git a/dom/media/tests/crashtests/1764940.html b/dom/media/tests/crashtests/1764940.html new file mode 100644 index 0000000000..67bce74b18 --- /dev/null +++ b/dom/media/tests/crashtests/1764940.html @@ -0,0 +1,14 @@ +<html> +<head> + <script> + document.addEventListener('DOMContentLoaded', async () => { + const peer = new RTCPeerConnection({ 'iceServers': [{ 'urls': 'stun:23.21.150.121' }] }) + const offer = await peer.createOffer({ 'offerToReceiveVideo': true }) + await peer.setRemoteDescription(offer) + const senders = peer.getSenders() + setTimeout(async () => await senders[1].setParameters({}), 334) + await peer.setRemoteDescription(offer) + }) + </script> +</head> +</html> diff --git a/dom/media/tests/crashtests/1766668.html b/dom/media/tests/crashtests/1766668.html new file mode 100644 index 0000000000..0ea142e563 --- /dev/null +++ b/dom/media/tests/crashtests/1766668.html @@ -0,0 +1,11 @@ +<!DOCTYPE html> +<script> + document.addEventListener('DOMContentLoaded', async () => { + await navigator.mediaDevices.getUserMedia({ 'audio': {} }) + const peer = new RTCPeerConnection({ 'iceServers': [{ 'urls': 'stun:23.21.150.121' }], 'peerIdentity': 'B' }, {}) + const stream = await navigator.mediaDevices.getUserMedia({ 'audio': {} }) + stream.getTracks().forEach((track) => peer.addTrack(track, stream)) + try { offer = await peer.createOffer({}) } catch (e) { } + await peer.setRemoteDescription(offer) + }) +</script> diff --git a/dom/media/tests/crashtests/1783765.html b/dom/media/tests/crashtests/1783765.html new file mode 100644 index 0000000000..333ad8d444 --- /dev/null +++ b/dom/media/tests/crashtests/1783765.html @@ -0,0 +1,22 @@ +<script> +var timeout = async function (cmd) { + const timer = new Promise((resolve, reject) => { + const id = setTimeout(() => { + clearTimeout(id) + reject(new Error('Promise timed out!')) + }, 750) + }) + return Promise.race([cmd, timer]) +} +window.addEventListener('load', async () => { + let a = new RTCPeerConnection({ + 'iceServers': [{'urls': 'stun:23.21.150.121'}], + 'peerIdentity': 'x', + }) + let b = await timeout(a.createOffer({ })) + a.setLocalDescription(b) + try { a.setRemoteDescription(b) } catch (e) {} + a.setLocalDescription(b) +}) +</script> + diff --git a/dom/media/tests/crashtests/780790.html b/dom/media/tests/crashtests/780790.html new file mode 100644 index 0000000000..27eb2a961f --- /dev/null +++ b/dom/media/tests/crashtests/780790.html @@ -0,0 +1,16 @@ +<!DOCTYPE HTML> +<html> +<!-- +https://bugzilla.mozilla.org/show_bug.cgi?id=780790 +--> +<head> + <meta charset="utf-8"> + <title>Simple gUM test - null success callback</title> + <script type="application/javascript"> + navigator.mozGetUserMedia({video: true, fake: true}, null, null); + </script> +</head> + +<body> +</body> +</html> diff --git a/dom/media/tests/crashtests/791270.html b/dom/media/tests/crashtests/791270.html new file mode 100644 index 0000000000..627552fb84 --- /dev/null +++ b/dom/media/tests/crashtests/791270.html @@ -0,0 +1,17 @@ +<!DOCTYPE HTML> +<html> +<!-- +https://bugzilla.mozilla.org/show_bug.cgi?id=791270 +--> +<head> + <meta charset="utf-8"> + <title>Simple PeerConnection Video Test</title> + <script type="application/javascript"> + var pc = new RTCPeerConnection(); + pc.addStream(undefined); + </script> +</head> + +<body> +</body> +</html> diff --git a/dom/media/tests/crashtests/791278.html b/dom/media/tests/crashtests/791278.html new file mode 100644 index 0000000000..fd538f6788 --- /dev/null +++ b/dom/media/tests/crashtests/791278.html @@ -0,0 +1,20 @@ +<!DOCTYPE HTML> +<html> +<!-- +https://bugzilla.mozilla.org/show_bug.cgi?id=791278 +--> +<head> + <meta charset="utf-8"> + <title>Simple PeerConnection Video Test - Invalid callback</title> + <script type="application/javascript"> + var pc1 = new RTCPeerConnection(); + pc1.setLocalDescription(function() {}); + + var pc2 = new RTCPeerConnection(); + pc2.setRemoteDescription(function() {}); + </script> +</head> + +<body> +</body> +</html> diff --git a/dom/media/tests/crashtests/791330.html b/dom/media/tests/crashtests/791330.html new file mode 100644 index 0000000000..fea2059a29 --- /dev/null +++ b/dom/media/tests/crashtests/791330.html @@ -0,0 +1,35 @@ +<!DOCTYPE HTML> +<html class="reftest-wait"> +<!-- +https://bugzilla.mozilla.org/show_bug.cgi?id=791330 +--> +<head> + <meta charset="utf-8"> + <title>PeerConnection test - operate on closed connection</title> + <script type="application/javascript"> + function finish() { + document.documentElement.removeAttribute("class"); + } + + function runTest() { + var pc = new RTCPeerConnection(); + pc.close(); + + navigator.mozGetUserMedia({audio: true, fake: true}, function (stream) { + try { + pc.addStream(stream); + pc.createOffer(function (offer) {}); + } + finally { + stream.getTracks().forEach(t => t.stop()); + + finish(); + } + }, function () {}); + } + </script> +</head> + +<body onload="setTimeout(runTest, 100)"> +</body> +</html> diff --git a/dom/media/tests/crashtests/799419.html b/dom/media/tests/crashtests/799419.html new file mode 100644 index 0000000000..7f815e73c8 --- /dev/null +++ b/dom/media/tests/crashtests/799419.html @@ -0,0 +1,32 @@ +<!DOCTYPE HTML> +<html class="reftest-wait"> +<!-- +https://bugzilla.mozilla.org/show_bug.cgi?id=799419 +--> +<head> + <meta charset="utf-8"> + <title>2 Peer Connections Create and Close + Fake Video</title> + <script type="application/javascript"> + function finish() { + document.documentElement.removeAttribute("class"); + } + + function boom() { + var v0 = new RTCPeerConnection(); + var v1 = new RTCPeerConnection(); + var v2 = document.getElementById("pc1video"); + var v3 = document.getElementById("pc2video"); + navigator.mozGetUserMedia({video:true, fake: true}, + function(stream) {}, function() {}); + v0.close(); + v1.close(); + + finish(); + } + </script> +</head> +<body onload="setTimeout(boom, 100)"> +<video id="pc1video" width="100" height="100" controls></video> +<video id="pc2video" width="100" height="100" controls></video> +</body> +</html> diff --git a/dom/media/tests/crashtests/801227.html b/dom/media/tests/crashtests/801227.html new file mode 100644 index 0000000000..2dded54510 --- /dev/null +++ b/dom/media/tests/crashtests/801227.html @@ -0,0 +1,35 @@ +<!DOCTYPE HTML> +<html class="reftest-wait"> +<!-- +https://bugzilla.mozilla.org/show_bug.cgi?id=801227 +--> +<head> + <meta charset="utf-8"> + <title>Abort due to page reload</title> + <script type="application/javascript"> + var pc = new RTCPeerConnection(); + + var index = localStorage.index || 0; + if (index < 3) { + localStorage.index = index + 1; + window.location.reload(); + } + + function finish() { + delete localStorage["index"]; + + pc.close(); + document.documentElement.removeAttribute("class"); + } + + navigator.mozGetUserMedia({ audio: true, fake: true }, function (aStream) { + pc.addStream(aStream); + finish(); + }, finish); + </script> +</head> + +<body> +</body> +</html> + diff --git a/dom/media/tests/crashtests/802982.html b/dom/media/tests/crashtests/802982.html new file mode 100644 index 0000000000..f034aff557 --- /dev/null +++ b/dom/media/tests/crashtests/802982.html @@ -0,0 +1,27 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<!-- +https://bugzilla.mozilla.org/show_bug.cgi?id=802982 +--> +<head> + <meta charset="utf-8"> + <title>Excessive getUserMedia calls</title> + <script type="application/javascript"> + + function finish() { + document.documentElement.removeAttribute("class"); + } + + function boom() + { + for (var j = 0; j < 100; ++j) { + navigator.mozGetUserMedia({video:true}, function(){}, function(){}); + } + finish(); // we're not waiting for success/error callbacks here + } + + </script> +</head> + +<body onload="setTimeout(boom, 100)"> +</html> diff --git a/dom/media/tests/crashtests/812785.html b/dom/media/tests/crashtests/812785.html new file mode 100644 index 0000000000..f26168e49b --- /dev/null +++ b/dom/media/tests/crashtests/812785.html @@ -0,0 +1,70 @@ +<!DOCTYPE HTML> +<html class="reftest-wait"> +<!-- +https://bugzilla.mozilla.org/show_bug.cgi?id=812785 +--> +<head> + <meta charset="utf-8"> + <title>Bug 812785 - WebRTC use-after-free crash</title> + <script type="application/javascript"> + var pc1, pc2, pc1_offer, pc2_answer, localAudio, remoteAudio; + + function onFailure(code) { + stop(); + } + + function stop() { + pc1.close(); pc1 = null; + pc2.close(); pc2 = null; + + var index = localStorage.index || 0; + if (index < 5) { + localStorage.index = index + 1; + window.location.reload(); + } + else { + finish(); + } + } + + function start() { + localAudio = document.getElementById("local"); + remoteAudio = document.getElementById("remote"); + + var stream = localAudio.mozCaptureStreamUntilEnded(); + + pc1 = new RTCPeerConnection(); + pc2 = new RTCPeerConnection(); + + pc1.addStream(stream); + pc1.createOffer(function (offer) { + pc1_offer = offer; + pc1.setLocalDescription(pc1_offer, function () { + pc2.setRemoteDescription(pc1_offer, function () { + pc2.createAnswer(function (answer) { + pc2_answer = answer; + pc2.setLocalDescription(pc2_answer, function () { + pc1.setRemoteDescription(pc2_answer, function step6() { + stop(); + }, onFailure); + }, onFailure); + }, onFailure); + }, onFailure); + }, onFailure); + }, onFailure); + } + + function finish() { + delete localStorage["index"]; + + document.documentElement.removeAttribute("class"); + } + </script> +</head> + +<body onload="setTimeout(start, 100)"> + <audio id="local" controls autoplay><source type="audio/wav" src="" /></audio> + <audio id="remote" controls></audio> +</body> +</html> + diff --git a/dom/media/tests/crashtests/822197.html b/dom/media/tests/crashtests/822197.html new file mode 100644 index 0000000000..97abc44229 --- /dev/null +++ b/dom/media/tests/crashtests/822197.html @@ -0,0 +1,28 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<!-- +https://bugzilla.mozilla.org/show_bug.cgi?id=822197 +--> +<head> + <meta charset="utf-8"> + <title>Bug 822197 - Many PeerConnections with CreateOffer</title> + <script type="application/javascript"> + var pcArray = []; + + function finish() { + document.documentElement.removeAttribute("class"); + } + + function start() { + for(var i = 0; i < 70; i++) { + var pc = new RTCPeerConnection(); + pc.createOffer(function() {}, function() {}); + pcArray.push(pc); + } + finish(); + } + </script> +</head> + +<body onload="setTimeout(start, 100)"> +</html> diff --git a/dom/media/tests/crashtests/834100.html b/dom/media/tests/crashtests/834100.html new file mode 100644 index 0000000000..0042581564 --- /dev/null +++ b/dom/media/tests/crashtests/834100.html @@ -0,0 +1,25 @@ +<html class="reftest-wait"> + <head> + <script language="javascript"> + +function start() { + remotePC = new RTCPeerConnection(); + var cand = new RTCIceCandidate( + {candidate: "1 1 UDP 1 127.0.0.1 34567 type host", + sdpMid: "helloworld", + sdbMid: "helloworld", // Mis-spelt attribute for bug 833948 compatibility. + sdpMLineIndex: 1 + }); + try {remotePC.addIceCandidate(cand);} catch(e) {} // bug 842075 - remove try when fixed + try {remotePC.addIceCandidate(cand, function(sdp){}, finish);} catch(e) {} // bug 842075 - remove try when fixed + finish(); +} + +function finish(arg) { + document.documentElement.removeAttribute("class"); +} + </script> + </head> + <body onload="setTimeout(start, 100)"> + </body> +</html> diff --git a/dom/media/tests/crashtests/836349.html b/dom/media/tests/crashtests/836349.html new file mode 100644 index 0000000000..651fde46ae --- /dev/null +++ b/dom/media/tests/crashtests/836349.html @@ -0,0 +1,20 @@ +<!DOCTYPE html> +<html> +<!-- +https://bugzilla.mozilla.org/show_bug.cgi?id=836349 +--> +<head> + <meta charset="utf-8"> + <title>Bug 836349</title> + <script type="application/javascript"> + function crash() + { + var pc = new RTCPeerConnection(); + var ld = pc.localDescription; + dump(ld.sdp); + } + </script> +</head> + +<body onload="crash();"> +</html> diff --git a/dom/media/tests/crashtests/837324.html b/dom/media/tests/crashtests/837324.html new file mode 100644 index 0000000000..63162a336b --- /dev/null +++ b/dom/media/tests/crashtests/837324.html @@ -0,0 +1,25 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<!-- +https://bugzilla.mozilla.org/show_bug.cgi?id=837324 +--> +<head> + <meta charset="utf-8"> + <title>Bug 837324</title> + <script type="application/javascript"> + function finish() { + document.documentElement.removeAttribute("class"); + } + + function start() { + var o0 = new RTCPeerConnection(); + var o1 = new RTCIceCandidate({"candidate":"0 -65535 IP 0 stun.sipgate.net 3227326073 type ::ffff:192.0.2.128 host 2302600701","sdpMid":"video 3907077665 RTP/SAVPF 5000","sdpMLineIndex":7}); + try {o0.addIceCandidate(o1);} catch(e) {} // bug 842075 - remove try when fixed + + finish(); + } + </script> +</head> + +<body onload="setTimeout(start, 100)"> +</html> diff --git a/dom/media/tests/crashtests/860143.html b/dom/media/tests/crashtests/860143.html new file mode 100644 index 0000000000..2d17a8dace --- /dev/null +++ b/dom/media/tests/crashtests/860143.html @@ -0,0 +1,25 @@ +<!DOCTYPE HTML> +<html> +<!-- +https://bugzilla.mozilla.org/show_bug.cgi?id=860143 +--> +<head> + <meta charset="utf-8"> + <title>bug 860143</title> + <script type="application/javascript"> + function start() { + var o0 = new window.RTCPeerConnection({ + iceServers: [ + { + url: "turn:AAAAAAAAAAAAAAAAA AAAAAAAAAAA AAAAAAAAAAAAA AA AAAAA AAAAAAAAAAA AAAAAAAAAAAAAAAA AAAAA AAAAAAAAAA, AAAAAAAAAAAAAAAA AAA AAAAAAAAAAAAAAA" + } + ] + }); + o0.close(); + } + </script> +</head> + +<body onload="start()"> +</body> +</html> diff --git a/dom/media/tests/crashtests/861958.html b/dom/media/tests/crashtests/861958.html new file mode 100644 index 0000000000..d6ea7e2e84 --- /dev/null +++ b/dom/media/tests/crashtests/861958.html @@ -0,0 +1,24 @@ +<!DOCTYPE HTML> +<html> +<!-- +https://bugzilla.mozilla.org/show_bug.cgi?id=861958 +--> +<head> + <meta charset="utf-8"> + <title>bug 861958</title> + <script type="application/javascript"> + function start() { + var o0 = new window.RTCPeerConnection(); + var o1 = o0.createDataChannel("foo", { + "protocol": "text/char", + "preset": false, + "stream": 512 + }); + o0.close(); + } + </script> +</head> + +<body onload="start()"> +</body> +</html> diff --git a/dom/media/tests/crashtests/crashtests.list b/dom/media/tests/crashtests/crashtests.list new file mode 100644 index 0000000000..c18d288aa1 --- /dev/null +++ b/dom/media/tests/crashtests/crashtests.list @@ -0,0 +1,42 @@ +defaults pref(media.peerconnection.enabled,true) pref(media.navigator.permission.disabled,true) pref(dom.disable_open_during_load,false) pref(media.devices.insecure.enabled,true) pref(media.getusermedia.insecure.enabled,true) + +load 780790.html +load 791270.html +load 791278.html +load 791330.html +load 799419.html +load 802982.html +skip-if(isDebugBuild) load 812785.html +load 834100.html +load 836349.html +load 837324.html +load 855796.html +load 860143.html +load 861958.html +load 863929.html +load 1281695.html +load 1306476.html +load 1348381.html +load 1367930_1.html +load 1367930_2.html +skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) asserts-if(Android,0-1) pref(browser.link.open_newwindow,2) load 1429507_1.html # window.open() in tab doesn't work for crashtest in e10s, this opens a new window instead +skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) asserts-if(Android,0-1) pref(browser.link.open_newwindow,2) load 1429507_2.html # window.open() in tab doesn't work for crashtest in e10s, this opens a new window instead +load 1443212.html +skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) asserts-if(Android,0-2) load 1453030.html +load 1468451.html +skip-if(Android|/^Windows\x20NT\x206\.1/.test(http.oscpu)) load 1490700.html # No screenshare on Android +skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) load 1505957.html +load 1509442.html +load 1511130.html +load 1510848.html +load 1516292.html +load 1576938.html +skip-if(Android) pref(media.getusermedia.audiocapture.enabled,true) load 1573536.html +skip-if(!Android) pref(media.getusermedia.audiocapture.enabled,true) pref(media.navigator.permission.device,false) load 1573536.html # media.navigator.permission.device is mobile-only, so other platforms fail to set it (Bug 1350948) +load 1594136.html +load 1749308.html +load 1764915.html +load 1764933.html +load 1764940.html +load 1766668.html +load 1783765.html diff --git a/dom/media/tests/crashtests/datachannel-oom.html b/dom/media/tests/crashtests/datachannel-oom.html new file mode 100644 index 0000000000..e55ec651be --- /dev/null +++ b/dom/media/tests/crashtests/datachannel-oom.html @@ -0,0 +1,22 @@ +<!DOCTYPE HTML> +<html> +<head> + <meta charset="utf-8"> + <title></title> + <script type="application/javascript"> + function start() { + var size = 2147483638; + new RTCPeerConnection().createDataChannel('a').send(new Uint8Array(size)); + var a = "a"; + var count = Math.floor(Math.log2(size)) - 1; + for (var i = 0; i < count; i++) { + a += a; + } + new RTCPeerConnection().createDataChannel('a').send(a) + } + </script> +</head> + +<body onload="start()"> +</body> +</html> |