diff options
Diffstat (limited to 'editor/libeditor/crashtests')
73 files changed, 1699 insertions, 0 deletions
diff --git a/editor/libeditor/crashtests/1057677.html b/editor/libeditor/crashtests/1057677.html new file mode 100644 index 000000000..d0b9497a5 --- /dev/null +++ b/editor/libeditor/crashtests/1057677.html @@ -0,0 +1,9 @@ +<html><body></body><script> +document.designMode = "on"; +var hrElem = document.createElement("HR"); +var select = window.getSelection(); +document.body.appendChild(hrElem); +select.collapse(hrElem,0); +document.execCommand("InsertHTML", false, "<div>foo</div><div>bar</div>"); +</script> +</html> diff --git a/editor/libeditor/crashtests/1128787.html b/editor/libeditor/crashtests/1128787.html new file mode 100644 index 000000000..fc6bff097 --- /dev/null +++ b/editor/libeditor/crashtests/1128787.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html> +<head> +<title>Bug 1128787</title> +</head> +<body> + <input type="button"/> + <script> + window.onload = function () { + document.designMode = "on"; + } + var input = document.getElementsByTagName("input")[0]; + input.focus(); + input.type = "text"; + </script> +</body> +</html> diff --git a/editor/libeditor/crashtests/1134545.html b/editor/libeditor/crashtests/1134545.html new file mode 100644 index 000000000..4e871804f --- /dev/null +++ b/editor/libeditor/crashtests/1134545.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<!-- saved from url=(0065)https://bug1134545.bugzilla.mozilla.org/attachment.cgi?id=8566418 --> +<html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"> +<script> + +function boom() +{ + textNode = document.createTextNode(" "); + x.appendChild(textNode); + x.setAttribute('contenteditable', "true"); + textNode.remove(); + window.getSelection().selectAllChildren(textNode); + document.execCommand("increasefontsize", false, null); +} + +</script> +</head> +<body onload="boom();"> +<div id="x" contenteditable="true"></div> + + +</body></html>
\ No newline at end of file diff --git a/editor/libeditor/crashtests/1158452.html b/editor/libeditor/crashtests/1158452.html new file mode 100644 index 000000000..56c74abd6 --- /dev/null +++ b/editor/libeditor/crashtests/1158452.html @@ -0,0 +1,10 @@ + +<div> +<div> +aaaaaaa +</script> +<script type="text/javascript"> +document.designMode = "on" +window.getSelection().modify("extend", "backward", "line") +document.execCommand("increasefontsize","",null); +</script> diff --git a/editor/libeditor/crashtests/1158651.html b/editor/libeditor/crashtests/1158651.html new file mode 100644 index 000000000..27278b523 --- /dev/null +++ b/editor/libeditor/crashtests/1158651.html @@ -0,0 +1,18 @@ +<script> +onload = function() { + var testContainer = document.createElement("span"); + testContainer.contentEditable = true; + document.body.appendChild(testContainer); + + function queryFormatBlock(content) + { + testContainer.innerHTML = content; + while (testContainer.firstChild) + testContainer = testContainer.firstChild; + window.getSelection().collapse(testContainer, 0); + document.queryCommandValue('formatBlock'); + } + + queryFormatBlock('<ol>hello</ol>'); +}; +</script> diff --git a/editor/libeditor/crashtests/1244894.xhtml b/editor/libeditor/crashtests/1244894.xhtml new file mode 100644 index 000000000..89a24751e --- /dev/null +++ b/editor/libeditor/crashtests/1244894.xhtml @@ -0,0 +1,21 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script> + +function boom() +{ + document.designMode = 'on'; + document.execCommand("indent", false, null); + document.execCommand("insertText", false, "a"); + document.execCommand("forwardDelete", false, null); + document.execCommand("justifyfull", false, null); +} + +window.addEventListener("load", boom, false); + +</script> +</head> + +<body> <span class="v"></span></body><body><input type="file" /></body> + +</html> diff --git a/editor/libeditor/crashtests/1272490.html b/editor/libeditor/crashtests/1272490.html new file mode 100644 index 000000000..a3c8ecd81 --- /dev/null +++ b/editor/libeditor/crashtests/1272490.html @@ -0,0 +1,20 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="utf-8"> +<script> +window.onload = function () { + var childDocument = document.getElementsByTagName("iframe")[0].contentDocument; + childDocument.designMode = "on"; + function onAttrModified(aEvent) { + childDocument.removeEventListener("DOMAttrModified", onAttrModified, false); + // Remove the editor from document during executing "insertOrderedList". + document.body.innerHTML = ""; + } + childDocument.addEventListener("DOMAttrModified", onAttrModified, false); + childDocument.execCommand("insertOrderedList", false, "1"); +} +</script> +</head> +<body><iframe></iframe></body> +</html> diff --git a/editor/libeditor/crashtests/1317704.html b/editor/libeditor/crashtests/1317704.html new file mode 100644 index 000000000..64359c796 --- /dev/null +++ b/editor/libeditor/crashtests/1317704.html @@ -0,0 +1,36 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="utf-8"> +<script> +addEventListener('DOMContentLoaded', function(){ + document.documentElement.className = 'lizard'; + setTimeout(function(){ + document.execCommand('selectAll', false, null); + document.designMode = 'on'; + document.execCommand('removeformat', false, null); + }, 0); +}); +</script> +<style> +.lizard{ + -webkit-user-select:all; +} +*{ + position:fixed; + display:table-column; +} +</style> +</head> +<body> +<span> +<span contenteditable> +<span class=lizard></span> +<span class=lizard></span> +<span /> +</span> +</span> +</span> +</span> +</body> +</html> diff --git a/editor/libeditor/crashtests/336081-1.xhtml b/editor/libeditor/crashtests/336081-1.xhtml new file mode 100644 index 000000000..da653c601 --- /dev/null +++ b/editor/libeditor/crashtests/336081-1.xhtml @@ -0,0 +1,52 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait"> +<head> +<script> +<![CDATA[ + +function foop(targetWindow) +{ + var targetDocument = targetWindow.document; + + var r1 = targetDocument.createRange(); + r1.setStart(targetDocument.getElementById("out1"), 0); + r1.setEnd (targetDocument.getElementById("out2"), 0); + targetWindow.getSelection().addRange(r1); + + var r2 = targetDocument.createRange(); + r2.setStart(targetDocument.getElementById("in1"), 0); + r2.setEnd (targetDocument.getElementById("in2"), 0); + targetWindow.getSelection().addRange(r2); + + targetDocument.execCommand('removeformat', false, null); + targetDocument.execCommand('outdent', false, null); +} + +function init() +{ + setTimeout(function() + { + var fd = window.frames[0].document; + fd.body.appendChild(fd.importNode(document.getElementById('rootish'), true)); + fd.designMode = 'on'; + foop(window.frames[0]); + document.documentElement.removeAttribute("class"); + }, 100); +} + +]]> +</script> +</head> + +<body onload="init()"> + +<iframe src="data:text/html," style="width: 95%; height: 500px;"/> + +<div id="rootish"> +<div id="out1"/> +<div id="in1"/> +<div id="in2"/> +<div id="out2"/> +</div> + +</body> +</html>
\ No newline at end of file diff --git a/editor/libeditor/crashtests/336104.html b/editor/libeditor/crashtests/336104.html new file mode 100644 index 000000000..32f11b745 --- /dev/null +++ b/editor/libeditor/crashtests/336104.html @@ -0,0 +1,37 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script> +function init() +{ + var targetWindow = window.frames[0]; + var targetDocument = targetWindow.document; + var rootish = document.getElementById('rootish'); + + targetDocument.body.appendChild(targetDocument.adoptNode(rootish)); + targetDocument.designMode = 'on'; + + targetWindow.getSelection().removeAllRanges(); + + var r = targetDocument.createRange(); + r.setStart(targetDocument.getElementById("start"), 0); + r.setEnd (targetDocument.getElementById("endparent").firstChild, 0); + targetWindow.getSelection().addRange(r); + + targetDocument.execCommand('outdent', false, null); +} +</script> + +</head> + +<body onload="setTimeout(init, 300);"> + +<iframe src="data:text/html," style="width: 95%; height: 500px;"></iframe> + +<div id="rootish"> + <div id="start"></div> + <p>Huh</p> + <svg xmlns="http://www.w3.org/2000/svg" id="endparent"> </svg> +</div> + +</body> +</html> diff --git a/editor/libeditor/crashtests/382527-1.html b/editor/libeditor/crashtests/382527-1.html new file mode 100644 index 000000000..2441dcd87 --- /dev/null +++ b/editor/libeditor/crashtests/382527-1.html @@ -0,0 +1,58 @@ +<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+
+
+function init1()
+{
+ targetIframe = document.createElementNS('http://www.w3.org/1999/xhtml', 'iframe');
+ targetIframe.src = "data:text/html,";
+ targetIframe.setAttribute("style", "width: 300px; height: 200px; border: 1px dotted green;");
+ targetIframe.addEventListener("load", init2, false);
+ document.body.appendChild(targetIframe);
+}
+
+
+function init2()
+{
+ targetWindow = targetIframe.contentWindow;
+ targetDocument = targetWindow.document;
+
+ var div = document.getElementById("div");
+ textNode = div.firstChild;
+
+ targetDocument.body.appendChild(targetDocument.adoptNode(div, true));
+
+ targetDocument.designMode = 'on';
+ setTimeout(init3, 0);
+}
+
+
+function init3()
+{
+ var rng = targetDocument.createRange();
+ rng.setStart(textNode, 1);
+ rng.setEnd(textNode, 1);
+ targetWindow.getSelection().addRange(rng);
+
+ try {
+ targetDocument.execCommand("inserthtml", false, "<p>");
+ } catch(e) {}
+
+ document.documentElement.removeAttribute("class");
+}
+
+
+</script>
+
+</head>
+
+<body onload="init1();">
+
+<div id="div"> </div>
+
+<script>
+</script>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/382778-1.html b/editor/libeditor/crashtests/382778-1.html new file mode 100644 index 000000000..960b16630 --- /dev/null +++ b/editor/libeditor/crashtests/382778-1.html @@ -0,0 +1,53 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<head> +<script> + +function init1() +{ + // Create an html:iframe in HTML mode (so designMode can be used 320092) + targetIframe = document.createElementNS('http://www.w3.org/1999/xhtml', 'iframe'); + targetIframe.src = "data:text/html,"; + targetIframe.setAttribute("style", "width: 700px; height: 500px; border: 1px dotted green;"); + targetIframe.addEventListener("load", init2, false); + document.body.appendChild(targetIframe); +} + + +function init2() +{ + targetWindow = targetIframe.contentWindow; + targetDocument = targetWindow.document; + + p = document.getElementById("p"); + pText = p.firstChild; + + targetDocument.body.appendChild(targetDocument.adoptNode(p, true)); + + targetDocument.designMode = 'on'; + + setTimeout(boom, 0); +} + + +function boom() +{ + var rng = targetDocument.createRange(); + rng.setStart(pText, 3); + rng.setEnd(pText, 3); + + targetWindow.getSelection().addRange(rng); + + targetDocument.execCommand("insertorderedlist", false, null); + + document.documentElement.removeAttribute("class") +} + +</script> +</head> + +<body onload="init1();"> +<p id="p">word word</p> +</body> + +</html> diff --git a/editor/libeditor/crashtests/402172-1.html b/editor/libeditor/crashtests/402172-1.html new file mode 100644 index 000000000..4022523fa --- /dev/null +++ b/editor/libeditor/crashtests/402172-1.html @@ -0,0 +1,23 @@ +<html> +<head> +<script> + +function boom() +{ + document.getElementById("div").contentEditable = "true"; + document.getElementById("div").focus(); + document.getElementById("div").contentEditable = "false"; + + document.getElementById("table").contentEditable = "true"; +} + +</script> +</head> + +<body onload="boom();"> + +<table id="table"><td></td></table><div id="div"></div> + +</body> + +</html> diff --git a/editor/libeditor/crashtests/403965-1.xhtml b/editor/libeditor/crashtests/403965-1.xhtml new file mode 100644 index 000000000..02993914d --- /dev/null +++ b/editor/libeditor/crashtests/403965-1.xhtml @@ -0,0 +1,7 @@ +<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"> +<tbody contenteditable="true"/> +<frameset/> +<xul:box onbeforecopy="event.explicitOriginalTarget.parentNode.parentNode.removeChild(event.explicitOriginalTarget.parentNode)"> +<xul:box/> +</xul:box> +</html>
\ No newline at end of file diff --git a/editor/libeditor/crashtests/407074-1.html b/editor/libeditor/crashtests/407074-1.html new file mode 100644 index 000000000..22f172856 --- /dev/null +++ b/editor/libeditor/crashtests/407074-1.html @@ -0,0 +1,7 @@ +<html> +<head> +</head> + +<body onload="try { document.execCommand('inserthtml', false, '0'); } catch(e) { }"><span id="textarea" contenteditable="true">is</span></body> + +</html> diff --git a/editor/libeditor/crashtests/407079-1.html b/editor/libeditor/crashtests/407079-1.html new file mode 100644 index 000000000..8b0e36cd6 --- /dev/null +++ b/editor/libeditor/crashtests/407079-1.html @@ -0,0 +1,15 @@ +<html> +<head> +<script type="text/javascript"> + +function boom() +{ + document.execCommand("selectAll", false, null); + document.execCommand("inserthtml", false, "<p>"); +} + +</script> +</head> + +<body onload="boom();"><textarea contenteditable="true"></textarea></body> +</html> diff --git a/editor/libeditor/crashtests/407256-1.html b/editor/libeditor/crashtests/407256-1.html new file mode 100644 index 000000000..824162ac5 --- /dev/null +++ b/editor/libeditor/crashtests/407256-1.html @@ -0,0 +1,23 @@ +<html> +<head> +<script type="text/javascript"> + +function boom() +{ + document.addEventListener("DOMNodeInserted", x, false); + + function x() + { + document.removeEventListener("DOMNodeInserted", x, false); + document.execCommand("insertParagraph", false, ""); + } + + document.execCommand("insertorderedlist", false, ""); +} + +</script> +</head> + +<body contenteditable="true" onload="boom()"></body> + +</html> diff --git a/editor/libeditor/crashtests/407277-1.html b/editor/libeditor/crashtests/407277-1.html new file mode 100644 index 000000000..41c6bf280 --- /dev/null +++ b/editor/libeditor/crashtests/407277-1.html @@ -0,0 +1,7 @@ +<html> +<head> +</head> +<body style="margin: initial;" + contenteditable="true" + onload="document.execCommand('outdent', false, null);"></body> +</html> diff --git a/editor/libeditor/crashtests/414178-1.html b/editor/libeditor/crashtests/414178-1.html new file mode 100644 index 000000000..19cc205b9 --- /dev/null +++ b/editor/libeditor/crashtests/414178-1.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html> +<head> +<script type="text/javascript"> + +function boom() +{ + var table = document.createElement("table"); + document.body.appendChild(table); + table.contentEditable = "true"; + table.focus(); + try { + // This will throw, since it's attempting to inject a list inside a table + document.execCommand("insertunorderedlist", false, null); + } catch (e) {} +} + +</script> +</head> + +<body onload="boom();"></body> +</html> diff --git a/editor/libeditor/crashtests/418923-1.html b/editor/libeditor/crashtests/418923-1.html new file mode 100644 index 000000000..786ea25d9 --- /dev/null +++ b/editor/libeditor/crashtests/418923-1.html @@ -0,0 +1,19 @@ +<html><head><script type="text/javascript"> + +function boom() +{ + var dE = document.documentElement; + var head = document.getElementsByTagName("head")[0]; + dE.removeChild(document.body); + dE.contentEditable = "true"; + dE.focus(); + dE.contentEditable = "false"; + head.focus(); + head.contentEditable = "true"; + try { + document.execCommand("selectAll", false, ""); + } catch(e) { + } +} + +</script></head><body onload="boom();"></body></html>
\ No newline at end of file diff --git a/editor/libeditor/crashtests/420439.html b/editor/libeditor/crashtests/420439.html new file mode 100644 index 000000000..e1303307d --- /dev/null +++ b/editor/libeditor/crashtests/420439.html @@ -0,0 +1,30 @@ +<html> +<head> +<script type="text/javascript"> + +function boom() +{ + function x() + { + document.removeEventListener("DOMAttrModified", x, false); + document.execCommand("backcolor", false, "green"); + } + + document.getElementById("td").focus(); + + document.addEventListener("DOMAttrModified", x, false); + try { + document.execCommand("subscript", false, null); + } catch(e) { + } + document.removeEventListener("DOMAttrModified", x, false); +} + +</script> +</head> + +<body contenteditable="true" onload="setTimeout(boom, 30);"> +<table><tbody contenteditable="false"><tr><td contenteditable="true" id="td"></td></tr></tbody></table> +</body> + +</html> diff --git a/editor/libeditor/crashtests/428489-1.html b/editor/libeditor/crashtests/428489-1.html new file mode 100644 index 000000000..8eec1268b --- /dev/null +++ b/editor/libeditor/crashtests/428489-1.html @@ -0,0 +1,8 @@ +<html>
+<head>
+<title>Crash [@ nsHTMLEditor::GetPositionAndDimensions] when window gets removed during click on contenteditable absolute positioned element</title>
+</head>
+<body>
+<iframe id="content" src="data:text/html;charset=utf-8,%3Chtml%3E%3Chead%3E%0A%3Cscript%3E%0Awindow.addEventListener%28%27DOMAttrModified%27%2C%20function%28e%29%20%7Bdump%28%27DOMAttrModified\n%27%29%3Bwindow.frameElement.parentNode.removeChild%28window.frameElement%29%3B%7D%2C%20true%29%3B%0A%3C/script%3E%0A%3C/head%3E%0A%3Cbody%3E%0A%3Cdiv%20style%3D%22position%3A%20absolute%3B%22%20contenteditable%3D%22true%22%3EClicking%20on%20this%20should%20not%20crash%20Mozilla%0A%3C/body%3E%0A%3C/html%3E" style="width:1000px;height: 300px;"></iframe>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/429586-1.html b/editor/libeditor/crashtests/429586-1.html new file mode 100644 index 000000000..a32df3b72 --- /dev/null +++ b/editor/libeditor/crashtests/429586-1.html @@ -0,0 +1,8 @@ +<html>
+<head>
+<title>Bug 429586 - Crash [@ nsEditor::EndUpdateViewBatch] with pasting and domattrmodified removing iframe</title>
+</head>
+<body>
+<iframe id="content" src="data:text/html;charset=utf-8,%3Chtml%3E%0A%3Chead%3E%0A%3C/head%3E%0A%3Cbody%20contenteditable%3D%22true%22%3E%0A%0A%3Cscript%3E%0Afunction%20dokey%28%29%7B%0Adocument.body.focus%28%29%3B%0Adocument.execCommand%28%27insertParagraph%27%2C%20false%2C%20%27%27%29%3B%0A%7D%0AsetTimeout%28dokey%2C200%29%3B%0A%0Adocument.addEventListener%28%27DOMAttrModified%27%2C%20function%28%29%20%7Bwindow.frameElement.parentNode.removeChild%28window.frameElement%29%7D%2C%20true%29%3B%0A%3C/script%3E%0A%3C/body%3E%0A%3C/html%3E"></iframe>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/430624-1.html b/editor/libeditor/crashtests/430624-1.html new file mode 100644 index 000000000..bfa95c662 --- /dev/null +++ b/editor/libeditor/crashtests/430624-1.html @@ -0,0 +1,14 @@ +<html> +<head> +<script> +function crash() { + window.frames[0].onload = null; + window.frames[0].location = 'data:text/html;charset=utf-8,2nd%20page'; +} +</script> +</head> +<body onload="crash()"> + <!-- iframe contents: <html><body onload="document.body.setAttribute('spellcheck', true);"></body></html> --> + <iframe src="data:text/html;charset=utf-8;base64,PGh0bWw%2BPGJvZHkgb25sb2FkPSJkb2N1bWVudC5ib2R5LnNldEF0dHJpYnV0ZSgnc3BlbGxjaGVjaycsIHRydWUpOyI%2BPC9ib2R5PjwvaHRtbD4%3D"></iframe> +</body> +</html>
\ No newline at end of file diff --git a/editor/libeditor/crashtests/431086-1.xhtml b/editor/libeditor/crashtests/431086-1.xhtml new file mode 100644 index 000000000..c6c5d8d99 --- /dev/null +++ b/editor/libeditor/crashtests/431086-1.xhtml @@ -0,0 +1,22 @@ +<div xmlns="http://www.w3.org/1999/xhtml"> + +<script type="text/javascript"> + +function boom() +{ + var r = document.documentElement; + r.style.position = "absolute"; + r.contentEditable = "true"; + r.focus(); + r.contentEditable = "false"; + r.focus(); + r.contentEditable = "true"; + document.execCommand("subscript", false, null); + r.contentEditable = "false"; +} + +window.addEventListener("load", boom, false); + +</script> + +</div> diff --git a/editor/libeditor/crashtests/448329-1.html b/editor/libeditor/crashtests/448329-1.html new file mode 100644 index 000000000..99d0f63b3 --- /dev/null +++ b/editor/libeditor/crashtests/448329-1.html @@ -0,0 +1,72 @@ +<!DOCTYPE HTML> +<html><head> + <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> + <title>Testcase for bug 448329</title> +</head> +<body> + +<iframe id="frame448329"></iframe> + +<script> + +function test448329(id,cmd) { + + var elm = document.getElementById(id); + var doc = elm.contentDocument; + doc.designMode = "On"; + + // Work around getSelection depending on a presshell but not flushing to get + // one. + doc.body.offsetWidth; + var s = doc.defaultView.getSelection(); + + // Test document node + if (s.rangeCount > 0) + s.removeAllRanges(); + var range = doc.createRange(); + range.setStart(doc, 0); + range.setEnd(doc, 0); + s.addRange(range); + doc.queryCommandIndeterm(cmd); + + // Test HTML node + if (s.rangeCount > 0) + s.removeAllRanges(); + range = doc.createRange(); + range.setStart(doc.documentElement, 0); + range.setEnd(doc.documentElement, 0); + s.addRange(range); + doc.queryCommandIndeterm(cmd); + + // Test BODY node + if (s.rangeCount > 0) + s.removeAllRanges(); + range = doc.createRange(); + var body = doc.documentElement.childNodes[1]; + range.setStart(body, 0); + range.setEnd(body, 0); + s.addRange(range); + doc.queryCommandIndeterm(cmd); + + var text = doc.createTextNode("Hello Kitty"); + body.insertBefore(text, null) + + // Test TEXT node + if (s.rangeCount > 0) + s.removeAllRanges(); + range = doc.createRange(); + range.setStart(text, 0); + range.setEnd(text, 1); + s.addRange(range); + doc.queryCommandIndeterm(cmd); + +} + +test448329("frame448329", "backcolor") +test448329("frame448329", "hilitecolor") + +</script> + + +</body> +</html> diff --git a/editor/libeditor/crashtests/448329-2.html b/editor/libeditor/crashtests/448329-2.html new file mode 100644 index 000000000..fd4707b54 --- /dev/null +++ b/editor/libeditor/crashtests/448329-2.html @@ -0,0 +1,21 @@ +<html> +<head> + <title>Testcase for bug 448329</title> +<script> +function go() { + test("myFrame", "backcolor"); +} +function test(id,cmd) { + var doc = document.getElementById(id).contentDocument; + doc.designMode = "On"; + + var s = doc.defaultView.getSelection(); + s.removeAllRanges(); + s.addRange(doc.createRange()); + + doc.queryCommandIndeterm(cmd); +} +</script> +</head> +<body onload="go()"><iframe id="myFrame"></iframe></body> +</html> diff --git a/editor/libeditor/crashtests/448329-3.html b/editor/libeditor/crashtests/448329-3.html new file mode 100644 index 000000000..0a48c1818 --- /dev/null +++ b/editor/libeditor/crashtests/448329-3.html @@ -0,0 +1,112 @@ +<!DOCTYPE HTML> +<html><head> + <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> + <title>Testcase #3 for bug 448329</title> +</head> +<body> + +<iframe id="frame448329"></iframe> + +<script> + +function test448329(id,cmd,val) { + + var elm = document.getElementById(id); + var doc = elm.contentDocument; + doc.designMode = "On"; + + // Work around getSelection depending on a presshell but not flushing to get + // one. + doc.body.offsetWidth; + var s = doc.defaultView.getSelection(); + + // Test document node + if (s.rangeCount > 0) + s.removeAllRanges(); + var range = doc.createRange(); + range.setStart(doc, 0); + range.setEnd(doc, 0); + s.addRange(range); + doc.execCommand(cmd,false,val); + + // Test HTML node + if (s.rangeCount > 0) + s.removeAllRanges(); + range = doc.createRange(); + range.setStart(doc.documentElement, 0); + range.setEnd(doc.documentElement, 0); + s.addRange(range); + doc.execCommand(cmd,false,val); + + // Test BODY node + if (s.rangeCount > 0) + s.removeAllRanges(); + range = doc.createRange(); + var body = doc.documentElement.childNodes[1]; + range.setStart(body, 0); + range.setEnd(body, 0); + s.addRange(range); + doc.execCommand(cmd,false,val); + + var text = doc.createTextNode("Hello Kitty"); + body.insertBefore(text, null) + + // Test TEXT node + if (s.rangeCount > 0) + s.removeAllRanges(); + range = doc.createRange(); + range.setStart(text, 0); + range.setEnd(text, 1); + s.addRange(range); + doc.execCommand(cmd,false,val); + + // Test BODY[0,0] + TEXT node + if (s.rangeCount > 0) + s.removeAllRanges(); + range = doc.createRange(); + range.setStart(body, 0); + range.setEnd(body, 0); + s.addRange(range); + range = doc.createRange(); + range.setStart(text, 0); + range.setEnd(text, 1); + s.addRange(range); + doc.execCommand(cmd,false,val); + + // Test BODY[0,1] + TEXT node + if (s.rangeCount > 0) + s.removeAllRanges(); + range = doc.createRange(); + range.setStart(body, 0); + range.setEnd(body, 1); + s.addRange(range); + range = doc.createRange(); + range.setStart(text, 0); + range.setEnd(text, 1); + s.addRange(range); + doc.execCommand(cmd,false,val); + + // Test BODY[0,1] + TEXT node without a parent + if (s.rangeCount > 0) + s.removeAllRanges(); + range = doc.createRange(); + range.setStart(body, 0); + range.setEnd(body, 1); + s.addRange(range); + range = doc.createRange(); + text = doc.createTextNode("Hello Kitty"); // not in doc + range.setStart(text, 0); + range.setEnd(text, 1); + s.addRange(range); + doc.execCommand(cmd,false,val); + +} + +test448329("frame448329", "backcolor", "green") +test448329("frame448329", "hilitecolor", "green") + +</script> + + +</body> +</html> diff --git a/editor/libeditor/crashtests/456727-1.html b/editor/libeditor/crashtests/456727-1.html new file mode 100644 index 000000000..d14422c93 --- /dev/null +++ b/editor/libeditor/crashtests/456727-1.html @@ -0,0 +1,8 @@ +<html> +<BODY onload=" +document.designMode='on'; +document.replaceChild(document.createElement('HTML'), document.firstChild); +document.queryCommandValue('backcolor'); +"> +</body> +</html>
\ No newline at end of file diff --git a/editor/libeditor/crashtests/456727-2.html b/editor/libeditor/crashtests/456727-2.html new file mode 100644 index 000000000..1c8fe5db9 --- /dev/null +++ b/editor/libeditor/crashtests/456727-2.html @@ -0,0 +1,8 @@ +<html> +<BODY onload=" +document.designMode='on'; +document.removeChild(document.firstChild); +document.queryCommandState('BackColor'); +"> +</body> +</html> diff --git a/editor/libeditor/crashtests/459613-iframe.html b/editor/libeditor/crashtests/459613-iframe.html new file mode 100644 index 000000000..9f6e558d0 --- /dev/null +++ b/editor/libeditor/crashtests/459613-iframe.html @@ -0,0 +1 @@ +<html><body><textarea>notaword</textarea></body></html> diff --git a/editor/libeditor/crashtests/459613.html b/editor/libeditor/crashtests/459613.html new file mode 100644 index 000000000..7a335f22e --- /dev/null +++ b/editor/libeditor/crashtests/459613.html @@ -0,0 +1,17 @@ +<html class="reftest-wait"> +<head> +<script type="text/javascript"> + +function finish() { + document.documentElement.removeAttribute("class"); +} + +</script> +</head> + +<body> + +<iframe src="459613-iframe.html" onload="finish();"></iframe> + +</body> +</html> diff --git a/editor/libeditor/crashtests/467647-1.html b/editor/libeditor/crashtests/467647-1.html new file mode 100644 index 000000000..7bb4271d7 --- /dev/null +++ b/editor/libeditor/crashtests/467647-1.html @@ -0,0 +1,19 @@ +<!DOCTYPE html> +<html> +<head> +<script type="text/javascript"> + +function boom() +{ + document.getElementById("s").focus(); + try { + document.execCommand("insertorderedlist", false, null); + } catch(e) { } +} + +</script> +</head> + +<body onload="boom();"><span id="s" contenteditable="true">One<div></div></span><marquee></marquee></body> + +</html> diff --git a/editor/libeditor/crashtests/475132-1.xhtml b/editor/libeditor/crashtests/475132-1.xhtml new file mode 100644 index 000000000..8b4dd688c --- /dev/null +++ b/editor/libeditor/crashtests/475132-1.xhtml @@ -0,0 +1,20 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script type="text/javascript"> + +function boom() +{ + document.getElementsByTagName("td")[0].contentEditable = "true"; + document.getElementsByTagName("td")[0].focus(); + document.documentElement.contentEditable = "true"; + document.documentElement.focus(); + document.execCommand("indent", false, null); + document.execCommand("insertParagraph", false, null); +} + +</script> +</head> + +<body onload="boom();" contenteditable="false"><td></td></body> + +</html> diff --git a/editor/libeditor/crashtests/499844-1.html b/editor/libeditor/crashtests/499844-1.html new file mode 100644 index 000000000..4fa509c4a --- /dev/null +++ b/editor/libeditor/crashtests/499844-1.html @@ -0,0 +1,15 @@ +<html> +<head> +<script type="text/javascript"> + +function boom() +{ + document.body.contentEditable = "true"; + document.execCommand("outdent", false, null); +} + +</script> +</head> + +<body style="word-spacing: 3px;" onload="boom();"> ́</body> +</html> diff --git a/editor/libeditor/crashtests/503709-1.xhtml b/editor/libeditor/crashtests/503709-1.xhtml new file mode 100644 index 000000000..867bebf1a --- /dev/null +++ b/editor/libeditor/crashtests/503709-1.xhtml @@ -0,0 +1,11 @@ +<html contenteditable="true" xmlns="http://www.w3.org/1999/xhtml"><head><script> + +function boom() +{ + document.execCommand("selectAll", false, ""); + try { document.execCommand("justifyfull", false, null); } catch(e) { } + try { document.execCommand("inserthorizontalrule", false, "false"); } catch(e) { } + document.execCommand("delete", false, null); +} + +</script></head>x y z<body onload="boom();"><div/></body></html> diff --git a/editor/libeditor/crashtests/513375-1.xhtml b/editor/libeditor/crashtests/513375-1.xhtml new file mode 100644 index 000000000..25e5e1c34 --- /dev/null +++ b/editor/libeditor/crashtests/513375-1.xhtml @@ -0,0 +1,19 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head contenteditable="true"> +<script type="text/javascript"> +<![CDATA[ + +function boom() +{ + var r = document.createRange(); + r.selectNode(document.body); + r.deleteContents(); + try { document.execCommand("selectAll", false, null); } catch(e) { } +} + +]]> +</script> +</head> + +<body onload="boom();" contenteditable="true"></body> +</html> diff --git a/editor/libeditor/crashtests/535632-1.xhtml b/editor/libeditor/crashtests/535632-1.xhtml new file mode 100644 index 000000000..92470b825 --- /dev/null +++ b/editor/libeditor/crashtests/535632-1.xhtml @@ -0,0 +1 @@ +<body xmlns="http://www.w3.org/1999/xhtml" style="margin: 200px;" contenteditable="true" onload="document.execCommand('outdent', false, null);" />
\ No newline at end of file diff --git a/editor/libeditor/crashtests/574558-1.xhtml b/editor/libeditor/crashtests/574558-1.xhtml new file mode 100644 index 000000000..6aac47072 --- /dev/null +++ b/editor/libeditor/crashtests/574558-1.xhtml @@ -0,0 +1,15 @@ +<html xmlns="http://www.w3.org/1999/xhtml"><head><script> +<![CDATA[ + +function boom() +{ + document.execCommand("selectAll", false, null); + document.execCommand("selectAll", false, null); + document.execCommand("inserthtml", false, "<span><div>"); + var textarea = document.getElementById("textarea"); + var span = document.createElementNS("http://www.w3.org/1999/xhtml", "span"); + textarea.appendChild(span); +} + +]]> +</script></head><div contenteditable="true"></div><body onload="boom();"><textarea id="textarea">f</textarea></body></html> diff --git a/editor/libeditor/crashtests/580151-1.xhtml b/editor/libeditor/crashtests/580151-1.xhtml new file mode 100644 index 000000000..379941111 --- /dev/null +++ b/editor/libeditor/crashtests/580151-1.xhtml @@ -0,0 +1,26 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +var t; + +function boom() +{ + var b = document.createElementNS("http://www.w3.org/1999/xhtml", "body"); + t = document.createElementNS("http://www.w3.org/1999/xhtml", "textarea"); + b.appendChild(t); + document.removeChild(document.documentElement) + document.appendChild(b) + document.removeChild(document.documentElement) + var ns = document.createElementNS("http://www.w3.org/1999/xhtml", "script"); + var nt = document.createTextNode("t.appendChild(document.createTextNode(' '));"); + ns.appendChild(nt); + b.appendChild(ns); + document.appendChild(b); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/editor/libeditor/crashtests/582138-1.xhtml b/editor/libeditor/crashtests/582138-1.xhtml new file mode 100644 index 000000000..afcec2eba --- /dev/null +++ b/editor/libeditor/crashtests/582138-1.xhtml @@ -0,0 +1,10 @@ +<html xmlns="http://www.w3.org/1999/xhtml"><mtr xmlns="http://www.w3.org/1998/Math/MathML"><td id="cell" xmlns="http://www.w3.org/1999/xhtml"></td></mtr><script> +function boom() +{ + document.getElementById("cell").contentEditable = true; + document.getElementById("cell").focus(); + document.execCommand("inserthtml", false, "x"); +} + +window.addEventListener("load", boom, false); +</script></html> diff --git a/editor/libeditor/crashtests/612565-1.html b/editor/libeditor/crashtests/612565-1.html new file mode 100644 index 000000000..1b059aa66 --- /dev/null +++ b/editor/libeditor/crashtests/612565-1.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html> + <body> + <iframe></iframe> + </body> + <script> + onload = function() { + var i = document.querySelector("iframe"); + var doc = i.contentDocument; + doc.body.appendChild(doc.createTextNode("foo")); + doc.designMode = "on"; + while (doc.body.firstChild) { + doc.body.removeChild(doc.body.firstChild); + } + }; + </script> +</html> diff --git a/editor/libeditor/crashtests/615015-1.html b/editor/libeditor/crashtests/615015-1.html new file mode 100644 index 000000000..a383f9e75 --- /dev/null +++ b/editor/libeditor/crashtests/615015-1.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + document.getElementById("j").focus(); + try { + document.execCommand("insertunorderedlist", false, null); + } catch(e) { } +} + +</script> +</head> +<body onload="boom();"><span><span contenteditable id="j"></span>T</span></body> +</html> diff --git a/editor/libeditor/crashtests/615450-1.html b/editor/libeditor/crashtests/615450-1.html new file mode 100644 index 000000000..fb36bddc9 --- /dev/null +++ b/editor/libeditor/crashtests/615450-1.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html contenteditable="true"> +<head> +<script> + +function boom() +{ + document.documentElement.appendChild(document.body); + document.documentElement.contentEditable = "false"; + try { document.execCommand("outdent", false, null); } catch(e) { } + document.body.contentEditable = "true"; + try { document.execCommand("inserthtml", false, "x"); } catch(e) { } +} + +</script> +</head> +<body onload="boom();"><div style="margin-left: 40px;"><span contenteditable="true">p q r s</span> T</div></body></html> diff --git a/editor/libeditor/crashtests/633709.xhtml b/editor/libeditor/crashtests/633709.xhtml new file mode 100644 index 000000000..139389001 --- /dev/null +++ b/editor/libeditor/crashtests/633709.xhtml @@ -0,0 +1,36 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait"> + +<body><div contenteditable="true"></div><div><input id="i"><div></div></input></div></body> + +<script id="s"> +<![CDATA[ + +function boom() +{ + document.getElementById("i").focus(); + + try { document.execCommand("stylewithcss", false, "true") } catch(e) { } + try { document.execCommand("inserthtml", false, "<x>X</x>"); } catch(e) { } + try { document.execCommand("underline", false, null); } catch(e) { } + try { document.execCommand("justifyfull", false, null); } catch(e) { } + try { document.execCommand("underline", false, null); } catch(e) { } + try { document.execCommand("insertParagraph", false, null); } catch(e) { } + try { document.execCommand("delete", false, null); } catch(e) { } + + try { document.execCommand("stylewithcss", false, "false") } catch(e) { } + try { document.execCommand("inserthtml", false, "<x>X</x>"); } catch(e) { } + try { document.execCommand("underline", false, null); } catch(e) { } + try { document.execCommand("justifyfull", false, null); } catch(e) { } + try { document.execCommand("underline", false, null); } catch(e) { } + try { document.execCommand("insertParagraph", false, null); } catch(e) { } + try { document.execCommand("delete", false, null); } catch(e) { } + + document.documentElement.removeAttribute("class"); +} + +setTimeout(boom, 10); + +]]> +</script> + +</html> diff --git a/editor/libeditor/crashtests/636074-1.html b/editor/libeditor/crashtests/636074-1.html new file mode 100644 index 000000000..e99c42ea6 --- /dev/null +++ b/editor/libeditor/crashtests/636074-1.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + document.getElementById("i").focus(); + document.documentElement.contentEditable = "true"; + document.execCommand("inserthtml", false, "<table>"); + document.execCommand("indent", false, null); + document.execCommand("delete", false, null); +} + +</script> +</head> +<body onload="boom();"><input id="i"></body> +</html> diff --git a/editor/libeditor/crashtests/639736-1.xhtml b/editor/libeditor/crashtests/639736-1.xhtml new file mode 100644 index 000000000..4692daee7 --- /dev/null +++ b/editor/libeditor/crashtests/639736-1.xhtml @@ -0,0 +1,14 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script> + +function boom() +{ + try { document.execCommand("removeformat", false, null); } catch(e) { } + document.adoptNode(document.documentElement); +} + +</script> +</head> +<body onload="boom();"><td contenteditable="true" /></body> +</html> diff --git a/editor/libeditor/crashtests/643786-1.html b/editor/libeditor/crashtests/643786-1.html new file mode 100644 index 000000000..3f0b27a54 --- /dev/null +++ b/editor/libeditor/crashtests/643786-1.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var f = document.getElementById("f"); + var fw = f.contentWindow; + fw.document.designMode = 'on'; + f.style.content = "'m'"; + fw.document.removeChild(fw.document.documentElement) +} + +</script> +</head> +<body onload="boom();"><iframe id="f" src="data:text/html,"></iframe></body> +</html> diff --git a/editor/libeditor/crashtests/650572-1.html b/editor/libeditor/crashtests/650572-1.html new file mode 100644 index 000000000..a86f6e618 --- /dev/null +++ b/editor/libeditor/crashtests/650572-1.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + document.documentElement.offsetHeight; + document.getElementById("d").focus(); + document.getElementById("b").style.display = "inline"; + document.getElementById("c").contentEditable = "false"; +} + +</script> +</head> +<body contenteditable="true" id="b" onload="setTimeout(boom, 200);"><div id="c"><input id="d"></div></body> +</html> + diff --git a/editor/libeditor/crashtests/667321-1.html b/editor/libeditor/crashtests/667321-1.html new file mode 100644 index 000000000..275269522 --- /dev/null +++ b/editor/libeditor/crashtests/667321-1.html @@ -0,0 +1,15 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + document.body.style.cssFloat = "left"; + document.createElement("div").appendChild(document.querySelector("legend")); +} + +</script> +</head> +<body onload="boom();"><fieldset><legend></legend><textarea></textarea></fieldset></body> +</html> diff --git a/editor/libeditor/crashtests/682650-1.html b/editor/libeditor/crashtests/682650-1.html new file mode 100644 index 000000000..66ebc2f62 --- /dev/null +++ b/editor/libeditor/crashtests/682650-1.html @@ -0,0 +1,30 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function repeatChar(s, n) +{ + while (s.length < n) + s += s; + return s.substr(0, n); +} + +function boom() +{ + document.documentElement.contentEditable = "true"; + document.execCommand("inserthtml", false, "<button><\/button>"); + document.execCommand("inserthtml", false, repeatChar("i", 34646)); + document.execCommand("contentReadOnly", false, null); + document.execCommand("removeformat", false, null); + document.execCommand("hilitecolor", false, "red"); + document.execCommand("inserthtml", false, "a"); + document.execCommand("delete", false, null); +} + +</script> +</head> + +<body onload="boom();"></body> + +</html> diff --git a/editor/libeditor/crashtests/713427-1.html b/editor/libeditor/crashtests/713427-1.html new file mode 100644 index 000000000..21da24693 --- /dev/null +++ b/editor/libeditor/crashtests/713427-1.html @@ -0,0 +1,9 @@ +<span>
+<script contenteditable="true"></script>
+<blockquote>
+<input>
+<code style="display: table-row;">
+<html contenteditable="true">
+</blockquote>
+
+
diff --git a/editor/libeditor/crashtests/713427-2.xhtml b/editor/libeditor/crashtests/713427-2.xhtml new file mode 100644 index 000000000..b04a5d773 --- /dev/null +++ b/editor/libeditor/crashtests/713427-2.xhtml @@ -0,0 +1,28 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script> +<![CDATA[ + +function boom() +{ + while (document.documentElement.firstChild) { + document.documentElement.removeChild(document.documentElement.firstChild); + } + + var td = document.createElementNS("http://www.w3.org/1999/xhtml", "td"); + td.setAttributeNS(null, "contenteditable", "true"); + (document.documentElement).appendChild(td); + var head = document.createElementNS("http://www.w3.org/1999/xhtml", "head"); + (document.documentElement).appendChild(head); + + head.appendChild(td); +} + +window.addEventListener("load", boom, false); + +]]> +</script> +</head> + +<body></body> +</html> diff --git a/editor/libeditor/crashtests/716456-1.html b/editor/libeditor/crashtests/716456-1.html new file mode 100644 index 000000000..a5ef5a2cc --- /dev/null +++ b/editor/libeditor/crashtests/716456-1.html @@ -0,0 +1,29 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<head> +<script> + +function boom() +{ + var div = document.querySelector("div"); + div.contentEditable = "true"; + div.focus(); + + var r = document.documentElement; + document["removeChild"](r); + document["appendChild"](r); + + setTimeout(function() { + getSelection().collapse(div, 0); + document.execCommand("inserthtml", false, "a"); + setTimeout(function() { + document.documentElement.removeAttribute("class"); + }, 0); + }, 0); +} + +</script> +</head> + +<body onload="boom();"><div></div></body> +</html> diff --git a/editor/libeditor/crashtests/759748.html b/editor/libeditor/crashtests/759748.html new file mode 100644 index 000000000..1e85a3877 --- /dev/null +++ b/editor/libeditor/crashtests/759748.html @@ -0,0 +1,58 @@ +<!doctype html> +<body> +<script> +var cmds = { + bold: "", + italic: "", + underline: "", + strikethrough: "", + subscript: "", + superscript: "", + cut: "", + copy: "", + paste: "", + delete: "", + forwarddelete: "", + selectall: "", + undo: "", + redo: "", + indent: "", + outdent: "", + backcolor: "#888888", + forecolor: "#888888", + hilitecolor: "#888888", + fontname: "Courier", + fontsize: "6", + increasefontsize: "", + decreasefontsize: "", + inserthorizontalrule: "", + createlink: "foo", + insertimage: "foo", + inserthtml: "foo", + inserttext: "foo", + insertparagraph: "", + gethtml: "", + justifyleft: "", + justifyright: "", + justifycenter: "", + justifyfull: "", + removeformat: "", + unlink: "", + insertorderedlist: "", + insertunorderedlist: "", + formatblock: "h1", + heading: "h1", + stylewithcss: "true", + usecss: "true", + contentreadonly: "true", + readonly: "true", + insertbronreturn: "true", + enableobjectresizing: "true", + enableinlinetableediting: "true", +}; +for (var k in cmds) { + document.body.innerHTML = "<div contenteditable>abc</div>"; + getSelection().removeAllRanges(); + try { document.execCommand(k, false, cmds[k]) } catch(e) {} +} +</script> diff --git a/editor/libeditor/crashtests/761861.html b/editor/libeditor/crashtests/761861.html new file mode 100644 index 000000000..0c1f3f521 --- /dev/null +++ b/editor/libeditor/crashtests/761861.html @@ -0,0 +1,15 @@ +<!doctype html> +<script> +function boom() { + var r = document.documentElement; + while (r.firstChild) { + r.removeChild(r.firstChild); + } + + document.documentElement.contentEditable = "true"; + document.documentElement.appendChild(document.createElement("span")); + document.documentElement.firstChild.appendChild(document.createTextNode("_")); + document.execCommand("forwarddelete"); +} +</script> +<body onload="boom()"> diff --git a/editor/libeditor/crashtests/762183.html b/editor/libeditor/crashtests/762183.html new file mode 100644 index 000000000..1916ac6fb --- /dev/null +++ b/editor/libeditor/crashtests/762183.html @@ -0,0 +1,6 @@ +<body contenteditable=true>x y +<script> +document.body.firstChild.splitText(2).splitText(1).splitText(1); +getSelection().collapse(document.body, 1); +document.execCommand("forwardDelete", false, null); +</script> diff --git a/editor/libeditor/crashtests/766305.html b/editor/libeditor/crashtests/766305.html new file mode 100644 index 000000000..a5000fe73 --- /dev/null +++ b/editor/libeditor/crashtests/766305.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var s = "x"; + for (var i = 0; i < 15; ++i) + s = s + s; + var t = document.createTextNode(s); + document.body.appendChild(t); + window.getSelection().collapse(t, s.length); + document.execCommand("insertText", false, "a"); +} + +</script> +</head> + +<body contenteditable="true" onload="boom();"></body> +</html> diff --git a/editor/libeditor/crashtests/766360.html b/editor/libeditor/crashtests/766360.html new file mode 100644 index 000000000..76c30456d --- /dev/null +++ b/editor/libeditor/crashtests/766360.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var r = document.createRange(); + r.setEnd(document.createTextNode("x"), 0); + window.getSelection().addRange(r); + document.execCommand("inserthtml", false, "y"); +} + +</script> +</head> + +<body contenteditable="true" onload="boom();"></body> +</html> diff --git a/editor/libeditor/crashtests/766387.html b/editor/libeditor/crashtests/766387.html new file mode 100644 index 000000000..20ccc60d4 --- /dev/null +++ b/editor/libeditor/crashtests/766387.html @@ -0,0 +1,20 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + window.getSelection().removeAllRanges(); + var r = document.createRange(); + r.setStart(document.getElementById("x"), 1); + r.setEnd(document.getElementById("y"), 0); + window.getSelection().addRange(r); + document.execCommand("insertorderedlist", false, null); +} + +</script> +</head> + +<body onload="boom();"><div id="x" contenteditable="true">a</div><div id="y" contenteditable="true"></div></body> +</html> diff --git a/editor/libeditor/crashtests/766413.html b/editor/libeditor/crashtests/766413.html new file mode 100644 index 000000000..c5d9835e3 --- /dev/null +++ b/editor/libeditor/crashtests/766413.html @@ -0,0 +1,42 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var root = document.documentElement; + while (root.firstChild) { + root.removeChild(root.firstChild); + } + + var space = document.createTextNode(" "); + var body = document.createElementNS("http://www.w3.org/1999/xhtml", "body"); + root.contentEditable = "true"; + root.focus(); + document.execCommand("contentReadOnly", false, null); + root.appendChild(body); + root.contentEditable = "false"; + root.appendChild(space); + root.removeChild(body); + root.contentEditable = "true"; + + window.getSelection().removeAllRanges(); + var r1 = document.createRange(); + r1.setStart(root, 0); + r1.setEnd(root, 0); + window.getSelection().addRange(r1); + looseText = document.createTextNode("c"); + var r2 = document.createRange(); + r2.setStart(looseText, 0); + r2.setEnd(looseText, 0); + window.getSelection().addRange(r2); + + document.execCommand("forwardDelete", false, null); +} + +</script> +</head> + +<body onload="boom();"></body> +</html> diff --git a/editor/libeditor/crashtests/766795.html b/editor/libeditor/crashtests/766795.html new file mode 100644 index 000000000..b4ade3020 --- /dev/null +++ b/editor/libeditor/crashtests/766795.html @@ -0,0 +1,21 @@ +<html> +<head> +<script> + +function boom() +{ + var fragEl = document.createElement("span"); + fragEl.setAttribute("contenteditable", "true"); + fragEl.setAttribute("style", "position: absolute;"); + + var frag = document.createDocumentFragment(); + frag.appendChild(fragEl); + + window.getSelection().selectAllChildren(fragEl); +} + +</script> +</head> + +<body contenteditable="true" onload="boom();"></body> +</html> diff --git a/editor/libeditor/crashtests/766845.xhtml b/editor/libeditor/crashtests/766845.xhtml new file mode 100644 index 000000000..409e21010 --- /dev/null +++ b/editor/libeditor/crashtests/766845.xhtml @@ -0,0 +1,27 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script> +<![CDATA[ + +function boom() +{ + window.getSelection().removeAllRanges(); + var r1 = document.createRange(); + r1.setStart(document.body, 0); + r1.setEnd (document.body, 1); + window.getSelection().addRange(r1); + var r2 = document.createRange(); + r2.setStart(document.body, 1); + r2.setEnd (document.body, 2); + window.getSelection().addRange(r2); + if (document.queryCommandEnabled("inserthtml")) + document.execCommand("inserthtml", false, "1"); +} + +]]> +</script> +</head> + +<body contenteditable="true" onload="boom();"><div></div><div></div></body> + +</html> diff --git a/editor/libeditor/crashtests/767169.html b/editor/libeditor/crashtests/767169.html new file mode 100644 index 000000000..3dfad160c --- /dev/null +++ b/editor/libeditor/crashtests/767169.html @@ -0,0 +1,23 @@ +<html> +<head> +<script> + +// Document must not have a doctype to trigger the bug + +function boom() +{ + var root = document.documentElement; + while (root.firstChild) { root.removeChild(root.firstChild); } + root.contentEditable = "true"; + document.removeChild(root); + document.appendChild(root); + window.getSelection().collapse(root, 0); + window.getSelection().extend(document, 1); + document.removeChild(root); +} + +</script> +</head> + +<body onload="boom();"></body> +</html> diff --git a/editor/libeditor/crashtests/768748.html b/editor/libeditor/crashtests/768748.html new file mode 100644 index 000000000..09206dce3 --- /dev/null +++ b/editor/libeditor/crashtests/768748.html @@ -0,0 +1,16 @@ +<!DOCTYPE html> +<html contenteditable="true"> +<head> +<script> + +function boom() +{ + var looseText = document.createTextNode("x"); + window.getSelection().collapse(looseText, 0); + document.queryCommandState("insertorderedlist"); +} + +</script> +</head> +<body onload="setTimeout(boom, 0)"></body> +</html> diff --git a/editor/libeditor/crashtests/768765.html b/editor/libeditor/crashtests/768765.html new file mode 100644 index 000000000..060e5161b --- /dev/null +++ b/editor/libeditor/crashtests/768765.html @@ -0,0 +1,36 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var root = document.documentElement; + + while (root.firstChild) { root.removeChild(root.firstChild); } + + var body = document.createElementNS("http://www.w3.org/1999/xhtml", "body"); + var div = document.createElementNS("http://www.w3.org/1999/xhtml", "div"); + root.contentEditable = "true"; + root.appendChild(div); + root.removeChild(div); + root.insertBefore(body, root.firstChild); + + window.getSelection().removeAllRanges(); + var r0 = document.createRange(); + r0.setStart(body, 0); + r0.setEnd(body, 0); + window.getSelection().addRange(r0); + var r1 = document.createRange(); + r1.setStart(div, 0); + r1.setEnd(div, 0); + window.getSelection().addRange(r1); + + document.execCommand("inserthtml", false, "1"); +} + +</script> +</head> + +<body onload="boom();"></body> +</html> diff --git a/editor/libeditor/crashtests/769008-1.html b/editor/libeditor/crashtests/769008-1.html new file mode 100644 index 000000000..8ea8a3601 --- /dev/null +++ b/editor/libeditor/crashtests/769008-1.html @@ -0,0 +1,23 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var x = document.getElementById("x"); + + window.getSelection().removeAllRanges(); + + var range = document.createRange(); + range.setStart(x, 0); + range.setEnd(x, 0); + window.getSelection().addRange(range); + + document.execCommand("delete", false, "null"); +} + +</script> +</head> +<body contenteditable="true" onload="boom();"><div></div><span id="x"></span></body> +</html> diff --git a/editor/libeditor/crashtests/769967.xhtml b/editor/libeditor/crashtests/769967.xhtml new file mode 100644 index 000000000..724f6b899 --- /dev/null +++ b/editor/libeditor/crashtests/769967.xhtml @@ -0,0 +1,16 @@ +<html xmlns="http://www.w3.org/1999/xhtml" contenteditable="true" style="-moz-user-select: all;"><sub>x</sub><script> +function boom() +{ + window.getSelection().removeAllRanges(); + var r = document.createRange(); + r.setStart(document.documentElement, 0); + r.setEnd(document.documentElement, 0); + window.getSelection().addRange(r); + + document.execCommand("subscript", false, null); + document.execCommand("insertText", false, "y"); +} + +window.addEventListener("load", boom, false); + +</script></html> diff --git a/editor/libeditor/crashtests/771749.html b/editor/libeditor/crashtests/771749.html new file mode 100644 index 000000000..9237364f2 --- /dev/null +++ b/editor/libeditor/crashtests/771749.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var root = document.documentElement; + root.contentEditable = "true"; + document.removeChild(root); + document.appendChild(root); + document.execCommand("insertunorderedlist", false, null); + document.execCommand("inserthtml", false, "<span></span>"); + document.execCommand("outdent", false, null); +} + +</script> +</head> + +<body onload="boom();"></body> +</html> diff --git a/editor/libeditor/crashtests/772282.html b/editor/libeditor/crashtests/772282.html new file mode 100644 index 000000000..f6259b344 --- /dev/null +++ b/editor/libeditor/crashtests/772282.html @@ -0,0 +1,27 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var root = document.documentElement; + while(root.firstChild) { root.removeChild(root.firstChild); } + var body = document.createElementNS("http://www.w3.org/1999/xhtml", "body"); + body.setAttributeNS(null, "contenteditable", "true"); + var img = document.createElementNS("http://www.w3.org/1999/xhtml", "img"); + body.appendChild(img); + root.appendChild(body); + document.removeChild(root); + document.appendChild(root); + document.execCommand("insertText", false, "5"); + document.execCommand("selectAll", false, null); + document.execCommand("insertParagraph", false, null); + document.execCommand("increasefontsize", false, null); +} + +</script> +</head> + +<body onload="boom();"></body> +</html> diff --git a/editor/libeditor/crashtests/776323.html b/editor/libeditor/crashtests/776323.html new file mode 100644 index 000000000..9fc2776c3 --- /dev/null +++ b/editor/libeditor/crashtests/776323.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html contenteditable="true"> +<head> +<script> + +function boom() +{ + document.execCommand("inserthtml", false, "b"); + var myrange = document.createRange(); + myrange.selectNodeContents(document.getElementsByTagName("img")[0]); + window.getSelection().addRange(myrange); + document.execCommand("strikethrough", false, null); +} + +</script> +</head> +<body onload="boom();"><img></body> +</html> diff --git a/editor/libeditor/crashtests/793866.html b/editor/libeditor/crashtests/793866.html new file mode 100644 index 000000000..4984474db --- /dev/null +++ b/editor/libeditor/crashtests/793866.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var b = document.body; + b.contentEditable = "true"; + document.execCommand("contentReadOnly", false, null); + b.focus(); + b.contentEditable = "false"; + document.documentElement.contentEditable = "true"; + document.createDocumentFragment().appendChild(b); + document.documentElement.focus(); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/editor/libeditor/crashtests/crashtests.list b/editor/libeditor/crashtests/crashtests.list new file mode 100644 index 000000000..3fbc6b196 --- /dev/null +++ b/editor/libeditor/crashtests/crashtests.list @@ -0,0 +1,71 @@ +load 336081-1.xhtml +load 336104.html +load 382527-1.html +load 382778-1.html +load 402172-1.html +load 403965-1.xhtml +load 407074-1.html +load 407079-1.html +load 407256-1.html +load 407277-1.html +load 414178-1.html +load 418923-1.html +load 420439.html +load 428489-1.html +load 429586-1.html +load 430624-1.html +load 431086-1.xhtml +load 448329-1.html +load 448329-2.html +load 448329-3.html +load 456727-1.html +load 456727-2.html +load 459613.html +needs-focus load 467647-1.html +load 475132-1.xhtml +load 499844-1.html +load 503709-1.xhtml +load 513375-1.xhtml +load 535632-1.xhtml +load 574558-1.xhtml +load 580151-1.xhtml +load 582138-1.xhtml +load 612565-1.html +load 615015-1.html +load 615450-1.html +load 633709.xhtml +load 636074-1.html +load 639736-1.xhtml +load 643786-1.html +load 650572-1.html +load 667321-1.html +load 682650-1.html +load 713427-1.html +load 713427-2.xhtml +load 716456-1.html +load 759748.html +load 761861.html +load 762183.html +load 766305.html +load 766360.html +load 766387.html +load 766413.html +load 766795.html +load 766845.xhtml +load 767169.html +load 768748.html +load 768765.html +load 769008-1.html +load 769967.xhtml +needs-focus load 771749.html +load 772282.html +load 776323.html +needs-focus load 793866.html +load 1057677.html +needs-focus load 1128787.html +load 1134545.html +load 1158452.html +load 1158651.html +load 1244894.xhtml +load 1272490.html +load 1317704.html |