summaryrefslogtreecommitdiffstats
path: root/dom/bindings/crashtests
diff options
context:
space:
mode:
Diffstat (limited to 'dom/bindings/crashtests')
-rw-r--r--dom/bindings/crashtests/1010658-1.html16
-rw-r--r--dom/bindings/crashtests/1010658-2.html16
-rw-r--r--dom/bindings/crashtests/769464.html11
-rw-r--r--dom/bindings/crashtests/822340-1.html11
-rw-r--r--dom/bindings/crashtests/822340-2.html8
-rw-r--r--dom/bindings/crashtests/832899.html5
-rw-r--r--dom/bindings/crashtests/860551.html4
-rw-r--r--dom/bindings/crashtests/860591.html20
-rw-r--r--dom/bindings/crashtests/862092.html19
-rw-r--r--dom/bindings/crashtests/862610.html20
-rw-r--r--dom/bindings/crashtests/869038.html22
-rw-r--r--dom/bindings/crashtests/949940.html16
-rw-r--r--dom/bindings/crashtests/crashtests.list12
13 files changed, 180 insertions, 0 deletions
diff --git a/dom/bindings/crashtests/1010658-1.html b/dom/bindings/crashtests/1010658-1.html
new file mode 100644
index 000000000..af46069c7
--- /dev/null
+++ b/dom/bindings/crashtests/1010658-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function boom()
+{
+ window.__proto__ = null;
+ for (var i = 0; i < 10000; ++i) {
+ self.document;
+ }
+}
+
+</script></head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/bindings/crashtests/1010658-2.html b/dom/bindings/crashtests/1010658-2.html
new file mode 100644
index 000000000..4b80242ec
--- /dev/null
+++ b/dom/bindings/crashtests/1010658-2.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function boom()
+{
+ window.__proto__ = function(){};
+ for (var i = 0; i < 10000; ++i) {
+ self.document;
+ }
+}
+
+</script></head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/bindings/crashtests/769464.html b/dom/bindings/crashtests/769464.html
new file mode 100644
index 000000000..84d6dbc08
--- /dev/null
+++ b/dom/bindings/crashtests/769464.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<script>
+
+function boom()
+{
+ window.getComputedStyle(new Worker("404.js"));
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
diff --git a/dom/bindings/crashtests/822340-1.html b/dom/bindings/crashtests/822340-1.html
new file mode 100644
index 000000000..4c8f6ae46
--- /dev/null
+++ b/dom/bindings/crashtests/822340-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<script>
+ var xhr = new XMLHttpRequest;
+ function f() {
+ var x = xhr.getResponseHeader;
+ x("abc");
+ }
+ for (var i = 0; i < 20000; ++i) {
+ try { f(); } catch (e) {}
+ }
+</script>
diff --git a/dom/bindings/crashtests/822340-2.html b/dom/bindings/crashtests/822340-2.html
new file mode 100644
index 000000000..e938c91aa
--- /dev/null
+++ b/dom/bindings/crashtests/822340-2.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<script>
+ var l = document.getElementsByTagName("*");
+ var count = 20000;
+ for (var i = 0; i < count; ++i) {
+ l.item(0);
+ }
+</script>
diff --git a/dom/bindings/crashtests/832899.html b/dom/bindings/crashtests/832899.html
new file mode 100644
index 000000000..c565ad00f
--- /dev/null
+++ b/dom/bindings/crashtests/832899.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<script>
+ var ev = document.createEvent("Events");
+ EventTarget.prototype.dispatchEvent.call(navigator.connection, ev);
+</script>
diff --git a/dom/bindings/crashtests/860551.html b/dom/bindings/crashtests/860551.html
new file mode 100644
index 000000000..5008e5739
--- /dev/null
+++ b/dom/bindings/crashtests/860551.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+SVGZoomAndPan instanceof SVGZoomAndPan
+</script>
diff --git a/dom/bindings/crashtests/860591.html b/dom/bindings/crashtests/860591.html
new file mode 100644
index 000000000..565a729c4
--- /dev/null
+++ b/dom/bindings/crashtests/860591.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+ var timeEvent = document.createEvent('TimeEvent');
+ var mutationEvent = document.createEvent('MutationEvents');
+ mutationEvent.__proto__ = timeEvent;
+ mutationEvent.target;
+
+ var mouseScrollEvent = document.createEvent("MouseScrollEvents");
+ var mouseEvent = document.createEvent("MouseEvents");
+ mouseEvent.__proto__ = mouseScrollEvent;
+ mouseEvent.relatedTarget;
+
+ var uiEvent = document.createEvent("UIEvents");
+ uiEvent.__proto__ = mouseScrollEvent;
+ uiEvent.rangeParent;
+</script>
+</head>
+</html>
diff --git a/dom/bindings/crashtests/862092.html b/dom/bindings/crashtests/862092.html
new file mode 100644
index 000000000..1b31775a9
--- /dev/null
+++ b/dom/bindings/crashtests/862092.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+ var frameDoc = document.getElementById("f").contentDocument;
+ frameDoc.adoptNode(document.createElement("select"));
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<iframe id="f"></iframe>
+</body>
+</html>
diff --git a/dom/bindings/crashtests/862610.html b/dom/bindings/crashtests/862610.html
new file mode 100644
index 000000000..768871ad9
--- /dev/null
+++ b/dom/bindings/crashtests/862610.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+ HTMLElement.prototype.__proto__ = new Proxy({}, {});
+ try {
+ window.Image;
+ } finally {
+ // Restore our prototype so the test harnesses can deal with us
+ // We can't just assign to __proto__ because it lives on our proto chain
+ // and we messed that up.
+ var desc = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__");
+ desc.set.call(HTMLElement.prototype, Element.prototype);
+ }
+</script>
+</head>
+
+<body></body>
+</html>
diff --git a/dom/bindings/crashtests/869038.html b/dom/bindings/crashtests/869038.html
new file mode 100644
index 000000000..dedb4dd4d
--- /dev/null
+++ b/dom/bindings/crashtests/869038.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+ var frame = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
+ document.body.appendChild(frame);
+ var frameDoc = frame.contentDocument;
+ frameDoc.contentEditable = "true";
+ document.body.removeChild(frame);
+ SpecialPowers.gc();
+ frameDoc.focus();
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/bindings/crashtests/949940.html b/dom/bindings/crashtests/949940.html
new file mode 100644
index 000000000..7f20085fe
--- /dev/null
+++ b/dom/bindings/crashtests/949940.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+function boom()
+{
+ var frameWin = document.getElementById("f").contentWindow;
+ Object.create(frameWin).self;
+}
+</script>
+</head>
+<body onload="boom()">
+<iframe id="f" src="data:text/html,3"></iframe>
+</body>
+</html>
diff --git a/dom/bindings/crashtests/crashtests.list b/dom/bindings/crashtests/crashtests.list
new file mode 100644
index 000000000..3b517dd88
--- /dev/null
+++ b/dom/bindings/crashtests/crashtests.list
@@ -0,0 +1,12 @@
+skip load 769464.html # bug 823822 - assert often leaks into other tests
+load 822340-1.html
+load 822340-2.html
+load 832899.html
+load 860551.html
+load 860591.html
+load 862092.html
+load 862610.html
+load 869038.html
+load 949940.html
+load 1010658-1.html
+load 1010658-2.html