diff options
| author | Matt A. Tobin <mattatobin@localhost.localdomain> | 2018-02-02 04:16:08 -0500 |
|---|---|---|
| committer | Matt A. Tobin <mattatobin@localhost.localdomain> | 2018-02-02 04:16:08 -0500 |
| commit | 5f8de423f190bbb79a62f804151bc24824fa32d8 (patch) | |
| tree | 10027f336435511475e392454359edea8e25895d /dom/bindings/crashtests | |
| parent | 49ee0794b5d912db1f95dce6eb52d781dc210db5 (diff) | |
| download | UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.gz UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.lz UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.xz UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.zip | |
Add m-esr52 at 52.6.0
Diffstat (limited to 'dom/bindings/crashtests')
| -rw-r--r-- | dom/bindings/crashtests/1010658-1.html | 16 | ||||
| -rw-r--r-- | dom/bindings/crashtests/1010658-2.html | 16 | ||||
| -rw-r--r-- | dom/bindings/crashtests/769464.html | 11 | ||||
| -rw-r--r-- | dom/bindings/crashtests/822340-1.html | 11 | ||||
| -rw-r--r-- | dom/bindings/crashtests/822340-2.html | 8 | ||||
| -rw-r--r-- | dom/bindings/crashtests/832899.html | 5 | ||||
| -rw-r--r-- | dom/bindings/crashtests/860551.html | 4 | ||||
| -rw-r--r-- | dom/bindings/crashtests/860591.html | 20 | ||||
| -rw-r--r-- | dom/bindings/crashtests/862092.html | 19 | ||||
| -rw-r--r-- | dom/bindings/crashtests/862610.html | 20 | ||||
| -rw-r--r-- | dom/bindings/crashtests/869038.html | 22 | ||||
| -rw-r--r-- | dom/bindings/crashtests/949940.html | 16 | ||||
| -rw-r--r-- | dom/bindings/crashtests/crashtests.list | 12 |
13 files changed, 180 insertions, 0 deletions
diff --git a/dom/bindings/crashtests/1010658-1.html b/dom/bindings/crashtests/1010658-1.html new file mode 100644 index 000000000..af46069c7 --- /dev/null +++ b/dom/bindings/crashtests/1010658-1.html @@ -0,0 +1,16 @@ +<!DOCTYPE html>
+<html>
+<head>
+<script>
+function boom()
+{
+ window.__proto__ = null;
+ for (var i = 0; i < 10000; ++i) {
+ self.document;
+ }
+}
+
+</script></head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/bindings/crashtests/1010658-2.html b/dom/bindings/crashtests/1010658-2.html new file mode 100644 index 000000000..4b80242ec --- /dev/null +++ b/dom/bindings/crashtests/1010658-2.html @@ -0,0 +1,16 @@ +<!DOCTYPE html>
+<html>
+<head>
+<script>
+function boom()
+{
+ window.__proto__ = function(){};
+ for (var i = 0; i < 10000; ++i) {
+ self.document;
+ }
+}
+
+</script></head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/bindings/crashtests/769464.html b/dom/bindings/crashtests/769464.html new file mode 100644 index 000000000..84d6dbc08 --- /dev/null +++ b/dom/bindings/crashtests/769464.html @@ -0,0 +1,11 @@ +<!DOCTYPE html> +<script> + +function boom() +{ + window.getComputedStyle(new Worker("404.js")); +} + +window.addEventListener("load", boom, false); + +</script> diff --git a/dom/bindings/crashtests/822340-1.html b/dom/bindings/crashtests/822340-1.html new file mode 100644 index 000000000..4c8f6ae46 --- /dev/null +++ b/dom/bindings/crashtests/822340-1.html @@ -0,0 +1,11 @@ +<!DOCTYPE html> +<script> + var xhr = new XMLHttpRequest; + function f() { + var x = xhr.getResponseHeader; + x("abc"); + } + for (var i = 0; i < 20000; ++i) { + try { f(); } catch (e) {} + } +</script> diff --git a/dom/bindings/crashtests/822340-2.html b/dom/bindings/crashtests/822340-2.html new file mode 100644 index 000000000..e938c91aa --- /dev/null +++ b/dom/bindings/crashtests/822340-2.html @@ -0,0 +1,8 @@ +<!DOCTYPE html> +<script> + var l = document.getElementsByTagName("*"); + var count = 20000; + for (var i = 0; i < count; ++i) { + l.item(0); + } +</script> diff --git a/dom/bindings/crashtests/832899.html b/dom/bindings/crashtests/832899.html new file mode 100644 index 000000000..c565ad00f --- /dev/null +++ b/dom/bindings/crashtests/832899.html @@ -0,0 +1,5 @@ +<!DOCTYPE html> +<script> + var ev = document.createEvent("Events"); + EventTarget.prototype.dispatchEvent.call(navigator.connection, ev); +</script> diff --git a/dom/bindings/crashtests/860551.html b/dom/bindings/crashtests/860551.html new file mode 100644 index 000000000..5008e5739 --- /dev/null +++ b/dom/bindings/crashtests/860551.html @@ -0,0 +1,4 @@ +<!DOCTYPE html> +<script> +SVGZoomAndPan instanceof SVGZoomAndPan +</script> diff --git a/dom/bindings/crashtests/860591.html b/dom/bindings/crashtests/860591.html new file mode 100644 index 000000000..565a729c4 --- /dev/null +++ b/dom/bindings/crashtests/860591.html @@ -0,0 +1,20 @@ +<!DOCTYPE html> +<html> +<head> +<script> + var timeEvent = document.createEvent('TimeEvent'); + var mutationEvent = document.createEvent('MutationEvents'); + mutationEvent.__proto__ = timeEvent; + mutationEvent.target; + + var mouseScrollEvent = document.createEvent("MouseScrollEvents"); + var mouseEvent = document.createEvent("MouseEvents"); + mouseEvent.__proto__ = mouseScrollEvent; + mouseEvent.relatedTarget; + + var uiEvent = document.createEvent("UIEvents"); + uiEvent.__proto__ = mouseScrollEvent; + uiEvent.rangeParent; +</script> +</head> +</html> diff --git a/dom/bindings/crashtests/862092.html b/dom/bindings/crashtests/862092.html new file mode 100644 index 000000000..1b31775a9 --- /dev/null +++ b/dom/bindings/crashtests/862092.html @@ -0,0 +1,19 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> + +function boom() +{ + var frameDoc = document.getElementById("f").contentDocument; + frameDoc.adoptNode(document.createElement("select")); +} + +</script> +</head> + +<body onload="boom();"> +<iframe id="f"></iframe> +</body> +</html> diff --git a/dom/bindings/crashtests/862610.html b/dom/bindings/crashtests/862610.html new file mode 100644 index 000000000..768871ad9 --- /dev/null +++ b/dom/bindings/crashtests/862610.html @@ -0,0 +1,20 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> + HTMLElement.prototype.__proto__ = new Proxy({}, {}); + try { + window.Image; + } finally { + // Restore our prototype so the test harnesses can deal with us + // We can't just assign to __proto__ because it lives on our proto chain + // and we messed that up. + var desc = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__"); + desc.set.call(HTMLElement.prototype, Element.prototype); + } +</script> +</head> + +<body></body> +</html> diff --git a/dom/bindings/crashtests/869038.html b/dom/bindings/crashtests/869038.html new file mode 100644 index 000000000..dedb4dd4d --- /dev/null +++ b/dom/bindings/crashtests/869038.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> + +function boom() +{ + var frame = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe"); + document.body.appendChild(frame); + var frameDoc = frame.contentDocument; + frameDoc.contentEditable = "true"; + document.body.removeChild(frame); + SpecialPowers.gc(); + frameDoc.focus(); +} + +</script> +</head> + +<body onload="boom();"></body> +</html> diff --git a/dom/bindings/crashtests/949940.html b/dom/bindings/crashtests/949940.html new file mode 100644 index 000000000..7f20085fe --- /dev/null +++ b/dom/bindings/crashtests/949940.html @@ -0,0 +1,16 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> +function boom() +{ + var frameWin = document.getElementById("f").contentWindow; + Object.create(frameWin).self; +} +</script> +</head> +<body onload="boom()"> +<iframe id="f" src="data:text/html,3"></iframe> +</body> +</html> diff --git a/dom/bindings/crashtests/crashtests.list b/dom/bindings/crashtests/crashtests.list new file mode 100644 index 000000000..3b517dd88 --- /dev/null +++ b/dom/bindings/crashtests/crashtests.list @@ -0,0 +1,12 @@ +skip load 769464.html # bug 823822 - assert often leaks into other tests +load 822340-1.html +load 822340-2.html +load 832899.html +load 860551.html +load 860591.html +load 862092.html +load 862610.html +load 869038.html +load 949940.html +load 1010658-1.html +load 1010658-2.html |