diff options
| author | Matt A. Tobin <mattatobin@localhost.localdomain> | 2018-02-02 04:16:08 -0500 |
|---|---|---|
| committer | Matt A. Tobin <mattatobin@localhost.localdomain> | 2018-02-02 04:16:08 -0500 |
| commit | 5f8de423f190bbb79a62f804151bc24824fa32d8 (patch) | |
| tree | 10027f336435511475e392454359edea8e25895d /dom/canvas/crashtests | |
| parent | 49ee0794b5d912db1f95dce6eb52d781dc210db5 (diff) | |
| download | UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.gz UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.lz UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.xz UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.zip | |
Add m-esr52 at 52.6.0
Diffstat (limited to 'dom/canvas/crashtests')
48 files changed, 877 insertions, 0 deletions
diff --git a/dom/canvas/crashtests/0px-size-font-667225.html b/dom/canvas/crashtests/0px-size-font-667225.html new file mode 100644 index 000000000..9de65f8f5 --- /dev/null +++ b/dom/canvas/crashtests/0px-size-font-667225.html @@ -0,0 +1,19 @@ +<html xmlns="http://www.w3.org/1999/xhtml" >
+<script language=javascript>
+
+function draw() {
+ var canv = document.getElementById("canv"); + var ctx = canv.getContext("2d"); + + ctx.fillStyle = "red"; + // 0 size font shouldn't crash! + ctx.font = "0px Arial"; + ctx.fillText("A", 0, 0); + document.documentElement.className = ""; +}
+
+</script>
+<body onload="draw()">
+<canvas id="canv" width="5" height="5"></canvas>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/0px-size-font-shadow.html b/dom/canvas/crashtests/0px-size-font-shadow.html new file mode 100644 index 000000000..1298f3fa1 --- /dev/null +++ b/dom/canvas/crashtests/0px-size-font-shadow.html @@ -0,0 +1,17 @@ +<!DOCTYPE HTML> +<body> +<canvas id="canv" width="5" height="5"></canvas> +<script> +var canv = document.getElementById("canv"); +var ctx = canv.getContext("2d"); + +ctx.fillStyle = "red"; +// 0 size font shouldn't assert! +ctx.font = "0px Arial"; +ctx.shadowColor = '#f00'; +ctx.shadowBlur = 4; +ctx.fillText("A", 0, 0); +document.documentElement.className = ""; +</script> +</body> +</html> diff --git a/dom/canvas/crashtests/1099143-1.html b/dom/canvas/crashtests/1099143-1.html new file mode 100644 index 000000000..30bb3a003 --- /dev/null +++ b/dom/canvas/crashtests/1099143-1.html @@ -0,0 +1,5 @@ +<script> + var canvas = document.createElement("canvas"); + var context = canvas.getContext("2d"); + context.fillText("", 0, 0); +</script> diff --git a/dom/canvas/crashtests/1161277-1.html b/dom/canvas/crashtests/1161277-1.html new file mode 100644 index 000000000..3e04dc46d --- /dev/null +++ b/dom/canvas/crashtests/1161277-1.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var canvas = document.createElement('canvas'); + var ctx = canvas.getContext('2d'); + ctx.setTransform(0.2988847856952777, 26589683732.25, -562949953421312, 5, 4503599627370495, -2735897607.139075); + ctx.bezierCurveTo(-1023, -4611686018427388000, 4194303, -536870911, 45139.65058316886, 35184372088833); + ctx.setLineDash([1.2307692307692308]); + ctx.setTransform(0, 2097152, 0.0005128205128205128, 305943.4982061649, -49282.263290019946, 3); + ctx.clip("evenodd"); + ctx.scale(-2.3882113703861325, -2); + ctx.isPointInStroke(2, 86124313031369.77); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/canvas/crashtests/1183363.html b/dom/canvas/crashtests/1183363.html new file mode 100644 index 000000000..2044a8092 --- /dev/null +++ b/dom/canvas/crashtests/1183363.html @@ -0,0 +1,23 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var ctx = canvas.getContext('2d'); + ctx.rect(2, 6, 9, 8); + ctx.setTransform(1, 2, 3, 0, 4, 1); + setTimeout(function() { + ctx.moveTo(0, 1); + ctx.isPointInPath(0, 0, 'evenodd'); + }, 0); +} + +</script> +</head> + +<body onload="boom();"> +<canvas id="canvas"></canvas> +</body> +</html> diff --git a/dom/canvas/crashtests/1190705.html b/dom/canvas/crashtests/1190705.html new file mode 100644 index 000000000..64795decb --- /dev/null +++ b/dom/canvas/crashtests/1190705.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var canvas = document.createElement('canvas'); + var ctx = canvas.getContext('2d'); + ctx.rotate(1e308); + ctx.fillText("A", 1, 1); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/canvas/crashtests/1223740-1.html b/dom/canvas/crashtests/1223740-1.html new file mode 100644 index 000000000..d5d969693 --- /dev/null +++ b/dom/canvas/crashtests/1223740-1.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> + +function boom() { + var canvas = document.createElement('canvas'); + var ctx = canvas.getContext('2d'); + ctx.shadowColor = "green"; + ctx.rotate(0.9923); + ctx.transform(6, 0.13807760834183488, 256, -0.39007851257689263, 0.5767177072299453, 64); + ctx.transform(0.61, 0.08697788582345888, 6, 6, 64, 128); + ctx.scale(0.36690500480283633, 6); + ctx.shadowOffsetY = -1.7976931348623157e+308; + ctx.fillText("A",32,0.848476537933684); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/canvas/crashtests/1225381-1.html b/dom/canvas/crashtests/1225381-1.html new file mode 100644 index 000000000..4519508a3 --- /dev/null +++ b/dom/canvas/crashtests/1225381-1.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> + +function boom() { + var canvas = document.createElement('canvas'); + var ctx = canvas.getContext('2d'); + ctx.mozCurrentTransformInverse = [32, -1, 0.8320478957221024, 1.7976931348623157e+308, 512, 0.9012573524148337]; + ctx.fillText("A", 0 ,0); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/canvas/crashtests/1229932-1.html b/dom/canvas/crashtests/1229932-1.html new file mode 100644 index 000000000..b5f06ff85 --- /dev/null +++ b/dom/canvas/crashtests/1229932-1.html @@ -0,0 +1,16 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> + +function boom() { + var canvas = document.createElement('canvas'); + var ctx = canvas.getContext('2d'); + ctx.fillText("A", 0, 1e308); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/canvas/crashtests/1229983-1.html b/dom/canvas/crashtests/1229983-1.html new file mode 100644 index 000000000..a865c569e --- /dev/null +++ b/dom/canvas/crashtests/1229983-1.html @@ -0,0 +1,24 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> + +function boom() { + var canvas = document.createElement('canvas'); + var ctx = canvas.getContext('2d'); + ctx.lineJoin = 'round'; + ctx.transform(18.5, 41.6, 447, 78.2, 85.75, 120.5); + ctx.transform(186.25, 26.142857142857142, 251.5, -562949953421311, 147, 4.625); + ctx.rotate(32); + ctx.arc(33.8, 1, 183, 141.5, 452.5, 0); + ctx.transform(423, 24.75, 78, 12, 180.25, 191.5); + ctx.shadowBlur = 31.5; + ctx.shadowColor = "blue"; + ctx.stroke(); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/canvas/crashtests/1233613.html b/dom/canvas/crashtests/1233613.html new file mode 100644 index 000000000..d949c3b21 --- /dev/null +++ b/dom/canvas/crashtests/1233613.html @@ -0,0 +1,19 @@ +<!DOCTYPE html> +<iframe style="display:none" srcdoc=" + +<html> +<head> +<script type='text/javascript'> +function boom() { + var gl = canvas.getContext('experimental-webgl'); + video.srcObject = canvas.captureStream(0); +} +</script> +</head> +<body onload='boom();'> + <video id='video' width='256' height='256'></video> + <canvas id='canvas' width='256' height='256'></canvas> +</body> +</html> + +"></iframe> diff --git a/dom/canvas/crashtests/1244850-1.html b/dom/canvas/crashtests/1244850-1.html new file mode 100644 index 000000000..015baf2c0 --- /dev/null +++ b/dom/canvas/crashtests/1244850-1.html @@ -0,0 +1,22 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> + +function boom() +{ + var canvas = document.createElement('canvas'); + var ctx = canvas.getContext('2d'); + var svgImage = document.getElementsByTagName("img")[0]; + ctx.drawImage(svgImage, 1e+308, 0); +} + +</script> +</head> +<body onload="boom();"> + +<img src="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' width='100' height='100'><rect width='100' height='100' fill='blue'/></svg>"> + +</body> +</html> diff --git a/dom/canvas/crashtests/1246775-1.html b/dom/canvas/crashtests/1246775-1.html new file mode 100644 index 000000000..8c4ddabdf --- /dev/null +++ b/dom/canvas/crashtests/1246775-1.html @@ -0,0 +1,15 @@ +<html> +<head> +<script> +function boom() +{ + var canvas = document.getElementById("canvas"); + var ctx = SpecialPowers.wrap(canvas.getContext("2d")); + ctx.drawWindow(window, 0, 0, canvas.width, canvas.height, "red"); +} +</script> +</head> +<body onload="boom();"> +<canvas id="canvas" width="10" height="10"></canvas> +</body> +</html> diff --git a/dom/canvas/crashtests/1283113-1.html b/dom/canvas/crashtests/1283113-1.html new file mode 100644 index 000000000..50234169b --- /dev/null +++ b/dom/canvas/crashtests/1283113-1.html @@ -0,0 +1,25 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var canvas = document.createElement('canvas'); + var ctx = canvas.getContext('2d'); + ctx.transform(1,1,0,0,0,0); + ctx.scale(610.561277214,0.0); + ctx.scale(442.538892637,64.9064087241); + ctx.scale(851.176724189,322.349092655); + ctx.scale(862.937434575,2.88757032711); + ctx.scale(230.933492526,766.024348731); + ctx.scale(968.538114712,4.580); + ctx.transform(1,0,1,0,1,0); + ctx.scale(341.640607159,753.362567174); + ctx.measureText(''); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/canvas/crashtests/1284356-1.html b/dom/canvas/crashtests/1284356-1.html new file mode 100644 index 000000000..bbdb135b0 --- /dev/null +++ b/dom/canvas/crashtests/1284356-1.html @@ -0,0 +1,9 @@ +<canvas id='i0'></canvas> +<script> +var c=document.getElementById('i0').getContext('2d'); +c.lineWidth=194.622602174; +c.miterLimit=270.273509738; +c.transform(0,0,0,0,0,0); +c.globalCompositeOperation='soft-light'; +c.strokeText('a',200,273,722); +</script>
\ No newline at end of file diff --git a/dom/canvas/crashtests/1284578-1.html b/dom/canvas/crashtests/1284578-1.html new file mode 100644 index 000000000..ba6e5f963 --- /dev/null +++ b/dom/canvas/crashtests/1284578-1.html @@ -0,0 +1,8 @@ +<canvas id='i0'></canvas> +<script> +var c=document.getElementById('i0').getContext('2d'); +c.bezierCurveTo(157,351,351,44,946,701); +c.quadraticCurveTo(260,-9007199254740991,945,145); +c.translate(-9007199254740991,239); +c.isPointInPath(988,439); +</script>
\ No newline at end of file diff --git a/dom/canvas/crashtests/1286458-1.html b/dom/canvas/crashtests/1286458-1.html new file mode 100644 index 000000000..1241a5f0e --- /dev/null +++ b/dom/canvas/crashtests/1286458-1.html @@ -0,0 +1,20 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var canvas = document.createElement('canvas'); + var ctx = canvas.getContext('2d'); + var path=new Path2D(); + path.bezierCurveTo(436,Number.MIN_VALUE,620,Number.MAX_SAFE_INTEGER,1,83); + ctx.setTransform(1,Number.MAX_SAFE_INTEGER,1,0,1,146.0); + ctx.scale(16777218,55); + ctx.stroke(path); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/canvas/crashtests/1287515-1.html b/dom/canvas/crashtests/1287515-1.html new file mode 100644 index 000000000..37dc8a2a0 --- /dev/null +++ b/dom/canvas/crashtests/1287515-1.html @@ -0,0 +1,7 @@ +<canvas id='i0'></canvas> +<script> +var c=document.getElementById('i0').getContext('2d'); +c.lineWidth=Number.MAX_SAFE_INTEGER; +c.setLineDash([1]); +c.strokeRect(1,1,0,Number.MIN_SAFE_INTEGER); +</script> diff --git a/dom/canvas/crashtests/1287652-1.html b/dom/canvas/crashtests/1287652-1.html new file mode 100644 index 000000000..7eaccd58a --- /dev/null +++ b/dom/canvas/crashtests/1287652-1.html @@ -0,0 +1,8 @@ +<canvas id='i0'></canvas> +<script> +var c=document.getElementById('i0').getContext('2d'); +var g=c.createLinearGradient(59,9,38.89,-75.51); +c.fillStyle=g; +c.globalAlpha=0.62; +c.fillText('a',0,24,30); +</script> diff --git a/dom/canvas/crashtests/1288872-1.html b/dom/canvas/crashtests/1288872-1.html new file mode 100644 index 000000000..de57311a5 --- /dev/null +++ b/dom/canvas/crashtests/1288872-1.html @@ -0,0 +1,6 @@ +<canvas id='id0'></canvas> +<script> +var c=document.getElementById('id0').getContext('2d'); +c.transform(1,0,1,0,0,0); +c.fillText('A',0,53); +</script>
\ No newline at end of file diff --git a/dom/canvas/crashtests/1290628-1.html b/dom/canvas/crashtests/1290628-1.html new file mode 100644 index 000000000..a2502f70a --- /dev/null +++ b/dom/canvas/crashtests/1290628-1.html @@ -0,0 +1,13 @@ +<!DOCTYPE html> +<html> +<body id='test_body'> +<canvas id='i0'></canvas> +<script> +var c=document.getElementById('i0').getContext('2d'); +c.shadowOffsetX=73; +c.scale(5,55); +c.setLineDash([48,81,88,41,32767,8]); +c.shadowColor='hsl(1.0,1%,1%)'; +c.miterLimit=Number.MIN_VALUE; +c.strokeRect(0,58,8589934591,0); +</script>
\ No newline at end of file diff --git a/dom/canvas/crashtests/1298576-1.html b/dom/canvas/crashtests/1298576-1.html new file mode 100644 index 000000000..b3936027e --- /dev/null +++ b/dom/canvas/crashtests/1298576-1.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html> +<head> +<script id="fshader" type="x-shader/x-fragment"> +void main() { + -2147483648 % 0xffffffff; + gl_FragColor = vec4(0.5, 0.5, 1.0, 1.0); +} +</script> +</head> +<body> +<script> +var gl = document.createElement('canvas').getContext('webgl'); +var program = gl.createProgram(); +var fshader = gl.createShader(gl.FRAGMENT_SHADER); +var fshaderSource = document.getElementById("fshader").text; +gl.shaderSource(fshader, fshaderSource); +gl.compileShader(fshader); +</script> +</body> +</html> diff --git a/dom/canvas/crashtests/1299062-1.html b/dom/canvas/crashtests/1299062-1.html new file mode 100644 index 000000000..2f33b889a --- /dev/null +++ b/dom/canvas/crashtests/1299062-1.html @@ -0,0 +1,5 @@ +<canvas id='id0' width='35376.4661501'></canvas> +<script> +var ctx=document.getElementById('id0').getContext('2d'); +ctx.getImageData(66,-1,32,87); +</script> diff --git a/dom/canvas/crashtests/1305312-1.html b/dom/canvas/crashtests/1305312-1.html new file mode 100644 index 000000000..3bd0b8c00 --- /dev/null +++ b/dom/canvas/crashtests/1305312-1.html @@ -0,0 +1,5 @@ +<canvas id='cid'></canvas> +<script> +var x=document.getElementById('cid').getContext('2d',{alpha: false}); +x.putImageData(x.createImageData(250,27434.63),Number.MAX_SAFE_INTEGER,23); +</script>
\ No newline at end of file diff --git a/dom/canvas/crashtests/1334647-1.html b/dom/canvas/crashtests/1334647-1.html new file mode 100644 index 000000000..b4510afeb --- /dev/null +++ b/dom/canvas/crashtests/1334647-1.html @@ -0,0 +1,8 @@ +<script> +Logger={}; Logger.JSError=function(e){}; +try { o0 = document.createElement('canvas'); } catch(e) { Logger.JSError(e); } +try { (document.body || document.documentElement).appendChild(o0) } catch(e) { Logger.JSError(e); } +try { o1 = o0.getContext('2d'); } catch(e) { Logger.JSError(e); } +try { o0.width = 311853383.455201; } catch(e) { Logger.JSError(e); } +try { o1.drawImage(o0, -0.906275445340731, 0.3679144809413502, 2, 32) } catch(e) { Logger.JSError(e); } +</script> diff --git a/dom/canvas/crashtests/1357092.html b/dom/canvas/crashtests/1357092.html new file mode 100644 index 000000000..110aa7e86 --- /dev/null +++ b/dom/canvas/crashtests/1357092.html @@ -0,0 +1,10 @@ +<html> + <head> + <script> + o1 = document.createElement("canvas"); + o1.setAttribute("width", "100000"); + o2 = o1.getContext("2d"); + o2.bezierCurveTo(64, 1, 1, 1, 1, 1); + </script> + </head> +</html> diff --git a/dom/canvas/crashtests/360293-1.html b/dom/canvas/crashtests/360293-1.html new file mode 100644 index 000000000..8a0859e41 --- /dev/null +++ b/dom/canvas/crashtests/360293-1.html @@ -0,0 +1,35 @@ +<html> + + +<body> + Firefox: <a href="javascript:noCrash()">no crash</a> | <a href="javascript:crash()">crash</a><br/> + <canvas id="foo" width="200" height="200"> + </canvas> + <script> + function d(lineWidth){ + var c = document.getElementById("foo").getContext("2d") + c.clearRect(0,0,200,200) + c.lineWidth = lineWidth + c.beginPath() + c.arc(100,100,80, Math.PI, 2*Math.PI, 1) + c.stroke() + c.beginPath() + c.arc(50,50, 20, 0, 2*Math.PI, 1) + c.stroke() + c.beginPath() + c.arc(150,50, 20, 0, 2*Math.PI, 1) + c.stroke() + } + function noCrash() { + d(Math.random()*20+5) + } + function crash() { + d( '_' ) + } + + crash(); + </script> + +</body> + +</html> diff --git a/dom/canvas/crashtests/421715-1.html b/dom/canvas/crashtests/421715-1.html new file mode 100644 index 000000000..c2ea9b28a --- /dev/null +++ b/dom/canvas/crashtests/421715-1.html @@ -0,0 +1,41 @@ +<!DOCTYPE html> +<html> + <head> + <script type="text/javascript"> + function stringify(a) { + if (a) + return a.toSource(); + return ''+a; + } + var args = [undefined, null, [], {}, 0, "0"]; + var stringArgs = args.map(stringify); + + function test_method(context, method, arity) { + function testParams(existingParams, depth) { + for (var arg of stringArgs) { + var code = "context[method](" + existingParams + arg + ")"; + try { + eval(code); + } catch (ex) { + // Exceptions are expected + } + + if (depth < arity) + testParams(existingParams + arg + ",", depth + 1); + } + } + testParams("", 1); + } + + function startTest() { + var canvas = document.getElementById("img"); + var context = canvas.getContext('2d');; + test_method(context, "getImageData", 4); + test_method(context, "putImageData", 3); + } + </script> + </head> + <body onload="startTest()"> + <canvas id="img">No canvas support.</canvas> + </body> +</html> diff --git a/dom/canvas/crashtests/553938-1.html b/dom/canvas/crashtests/553938-1.html new file mode 100644 index 000000000..97e6b6c8a --- /dev/null +++ b/dom/canvas/crashtests/553938-1.html @@ -0,0 +1,20 @@ +<!doctype html> +<html> + <head> + <meta http-equiv="content-type" content="text/html; charset=UTF-8"> + <title>ImageData Crash Test</title> + </head> + <body onload="crash();"> + <canvas id="c" width="10" height="10"></canvas> + <script> + function crash() { + var canvas = document.getElementById('c'); + var ctx = canvas.getContext('2d'); + var imgData = {data: new Array(10*10*4), width: 10, height: 10}; + + imgData[0] = 0; + ctx.putImageData(imgData, 0, 0); + } + </script> + </body> +</html> diff --git a/dom/canvas/crashtests/647480.html b/dom/canvas/crashtests/647480.html new file mode 100644 index 000000000..15b6b6a1b --- /dev/null +++ b/dom/canvas/crashtests/647480.html @@ -0,0 +1,104 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var canvas = document.createElementNS("http://www.w3.org/1999/xhtml", "canvas"); + var ctx = canvas.getContext("2d"); + document.implementation.createDocument("", "", null).adoptNode(canvas); + + try { ctx.save(); } catch(e){} + try { ctx.restore(); } catch(e){} + try { ctx.scale(0,0); } catch(e){} + try { ctx.rotate(90); } catch(e){} + try { ctx.translate(1,1); } catch(e){} + try { ctx.transform(0,100,200,300,10,10); } catch(e){} + try { ctx.setTransform(0,100,200,300,10,10); } catch(e){} + + try { x = ctx.globalAlpha; } catch(e){} + try { ctx.globalAlpha = 0.8; } catch(e){} + try { x = ctx.globalCompositeOperation; } catch(e){} + try { ctx.globalCompositeOperation = "copy"; } catch(e){} + try { x = ctx.strokeStyle; } catch(e){} + try { ctx.strokeStyle = "red"; } catch(e){} + try { x = ctx.fillStyle; } catch(e){} + try { ctx.fillStyle = "red"; } catch(e){} + + try { ctx.createLinearGradient(0,100,100,100); } catch(e){} + try { ctx.createRadialGradient(0,100,100,100,10,10); } catch(e){} + try { ctx.createPattern(document.getElementsByTagName('img')[0], "repeat"); } catch(e){} + + try { x = ctx.lineWidth; } catch(e){} + try { ctx.lineWidth = 2; } catch(e){} + try { x = ctx.lineCap; } catch(e){} + try { ctx.lineCap = "round"; } catch(e){} + try { x = ctx.lineJoin; } catch(e){} + try { ctx.lineJoin = "bevel"; } catch(e){} + try { x = ctx.miterLimit; } catch(e){} + try { ctx.miterLimit = 12; } catch(e){} + + try { x = ctx.shadowOffsetX; } catch(e){} + try { ctx.shadowOffsetX = 1; } catch(e){} + try { x = ctx.shadowOffsetY; } catch(e){} + try { ctx.shadowOffsetY = 1; } catch(e){} + try { x = ctx.shadowBlur; } catch(e){} + try { ctx.shadowBlur = 1; } catch(e){} + try { x = ctx.shadowColor; } catch(e){} + try { ctx.shadowColor = "red"; } catch(e){} + + try { ctx.clearRect(0,0,100,100); } catch(e){} + try { ctx.fillRect(0,0,100,100); } catch(e){} + try { ctx.strokeRect(0,0,100,100); } catch(e){} + + try { ctx.beginPath(); } catch(e){} + try { ctx.moveTo(1,1); } catch(e){} + try { ctx.lineTo(10,10); } catch(e){} + try { ctx.quadraticCurveTo(1,2,3,4); } catch(e){} + try { ctx.bezierCurveTo(1,2,3,4,5,6); } catch(e){} + try { ctx.arcTo(1,2,3,4,5); } catch(e){} + try { ctx.arc(1,2,3,4,5); } catch(e){} + try { ctx.arc(1,2,3,4,5,true); } catch(e){} + try { ctx.rect(1,2,3,4); } catch(e){} + try { ctx.closePath(); } catch(e){} + + try { ctx.fill(); } catch(e){} + try { ctx.stroke(); } catch(e){} + try { ctx.clip(); } catch(e){} + + try { x = ctx.font; } catch(e){} + try { ctx.font = "14px sans-serif"; } catch(e){} + try { x = ctx.mozTextStyle; } catch(e){} + try { ctx.mozTextStyle = "14px sans-serif"; } catch(e){} + try { x = ctx.textAlign; } catch(e){} + try { ctx.textAlign = "right"; } catch(e){} + try { x = ctx.textBaseline; } catch(e){} + try { ctx.textBaseline = "top"; } catch(e){} + + try { ctx.fillText("",0,0); } catch(e){} + try { ctx.strokeText("",0,0); } catch(e){} + try { ctx.measureText(""); } catch(e){} + + try { ctx.mozDrawText(""); } catch(e){} + try { ctx.mozPathText(""); } catch(e){} + try { ctx.mozTextAlongPath("",true); } catch(e){} + try { ctx.mozTextAlongPath("",false); } catch(e){} + + try { ctx.drawImage(document.getElementsByTagName('img')[0], 0, 0); } catch(e){} + try { ctx.isPointInPath(0, 0); } catch(e){} + try { ctx.createImageData(); } catch(e){} + try { ctx.getImageData(); } catch(e){} + try { ctx.putImageData(); } catch(e){} + + try { x = ctx.imageSmoothingEnabled; } catch(e){} + try { ctx.imageSmoothingEnabled = false; } catch(e){} + try { ctx.imageSmoothingEnabled = true; } catch(e){} + + try { ctx.drawWindow(window, 0, 0, 0, 0, "red"); } catch(e){} +} + +</script> +</head> +<body onload="boom();"><img width="100" height="100" src="data:image/gif;base64,R0lGODlhAQABAIABAAD/AP///ywAAAAAAQABAAACAkQBADs="></body> +</html> diff --git a/dom/canvas/crashtests/727547.html b/dom/canvas/crashtests/727547.html new file mode 100644 index 000000000..005841de8 --- /dev/null +++ b/dom/canvas/crashtests/727547.html @@ -0,0 +1,7 @@ +<!doctype html> +<canvas></canvas> +<script> +var canvas = document.body.firstChild, + gl = canvas.getContext("experimental-webgl"); +gl.texImage2D(0, 0, 0, 0, 0, { width: 10, height: 10, data: 7 }); +</script> diff --git a/dom/canvas/crashtests/729116.html b/dom/canvas/crashtests/729116.html new file mode 100644 index 000000000..679f9d296 --- /dev/null +++ b/dom/canvas/crashtests/729116.html @@ -0,0 +1,18 @@ +<html>
+<script language=javascript>
+
+function draw() {
+ var canv = document.getElementById("canv"); + var ctx = canv.getContext("2d");
+ try {
+ canv.width = 50000;
+ } catch (e) { }
+
+ ctx.clearRect(0, 0, 10, 10); +}
+
+</script>
+<body onload="draw()">
+<canvas id="canv" width="5" height="5"></canvas>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/743499-negative-size.html b/dom/canvas/crashtests/743499-negative-size.html new file mode 100644 index 000000000..7cfcd55b2 --- /dev/null +++ b/dom/canvas/crashtests/743499-negative-size.html @@ -0,0 +1,22 @@ +<html> +<head> + <title></title> + <script type="text/javascript"> + function go() { + var canvas = document.createElement("canvas"); + var ctx = canvas.getContext('2d'); + ctx.globalAlpha = 4 + ctx.lineCap = "foo" + ctx.strokeRect(256,1024,8,4) + ctx.shadowColor = "black" + ctx.shadowOffsetY = 64 + ctx.stroke() + ctx.moveTo(32,1024) + ctx.closePath() + } + </script> +</head> +<body onload="go()"> +<canvas id="canvas"></canvas> +</body> +</html>
\ No newline at end of file diff --git a/dom/canvas/crashtests/745699-1.html b/dom/canvas/crashtests/745699-1.html new file mode 100644 index 000000000..c65acf201 --- /dev/null +++ b/dom/canvas/crashtests/745699-1.html @@ -0,0 +1,25 @@ +<!DOCTYPE html> +<html> +<head> +<style> +@font-face { + font-family: "z"; + src: url(invalid); +} +</style> + +<script> +function boom() +{ + var ctx = document.querySelector("canvas").getContext('2d'); + ctx.font = "10px serif"; + document.querySelector("style").appendChild(document.createTextNode(" ")); + ctx.measureText("123"); +} +</script> +</head> + +<body onload="boom();"> +<canvas width="100" height="100"></canvas> +</body> +</html> diff --git a/dom/canvas/crashtests/745818-large-source.html b/dom/canvas/crashtests/745818-large-source.html new file mode 100644 index 000000000..a5be76be0 --- /dev/null +++ b/dom/canvas/crashtests/745818-large-source.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var a = document.getElementById("a"); + var b = document.getElementById("b"); + a.getContext('2d').createPattern(b, 'no-repeat'); +} + +</script> +</head> + +<body onload="boom();"> +<canvas id="a" width="61" height="26"></canvas> +<canvas id="b" width="611" height="439807"></canvas> +</body> + +</html> diff --git a/dom/canvas/crashtests/746813-1.html b/dom/canvas/crashtests/746813-1.html new file mode 100644 index 000000000..18e52b4c9 --- /dev/null +++ b/dom/canvas/crashtests/746813-1.html @@ -0,0 +1,6 @@ +<!DOCTYPE html> +<html> +<body onload="document.getElementById('c').getContext('2d').mozCurrentTransformInverse;"> +<canvas id="c" width="772" height="76441"></canvas> +</body> +</html> diff --git a/dom/canvas/crashtests/767337-1.html b/dom/canvas/crashtests/767337-1.html new file mode 100644 index 000000000..3c2c4ebd1 --- /dev/null +++ b/dom/canvas/crashtests/767337-1.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html> +<body> +<canvas id="c" width="500" height="1000"> +</canvas> +<script> +var ctxt = document.getElementById('c').getContext('2d'); +for (var k = 0; k < 100; ++j) { + for (var j = 0; j < 10; ++j) { + for (var i = 0; i < 1000; ++i) { + gradient = ctxt.createLinearGradient(0,0,200,i); + gradient.addColorStop(0,'black'); + gradient.addColorStop(1,'rgba(0, 255*k/100, 0, 0.1)'); + ctxt.fillStyle = gradient; + ctxt.fillRect(j*50, 2*i, 50, 2); + } + } +} +</script> +</body> +</html>
\ No newline at end of file diff --git a/dom/canvas/crashtests/779426.html b/dom/canvas/crashtests/779426.html new file mode 100644 index 000000000..ded3455b8 --- /dev/null +++ b/dom/canvas/crashtests/779426.html @@ -0,0 +1,19 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var canvas = document.createElementNS('http://www.w3.org/1999/xhtml', 'canvas'); + var canvas2d = canvas.getContext('2d'); + canvas2d.rect(0, 0, 1, 1); + canvas2d.transform(1, 0, 0, 1, 0, 0); + canvas.setAttributeNS(null, "height", "99"); + canvas2d.rect(0, 0, 1, 1); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/canvas/crashtests/780392-1.html b/dom/canvas/crashtests/780392-1.html new file mode 100644 index 000000000..2112c9a75 --- /dev/null +++ b/dom/canvas/crashtests/780392-1.html @@ -0,0 +1,10 @@ +<!doctype HTML> +<html> +<body> +<canvas id="c" width="10000" height="10000"></canvas> +<script> +var ctx = document.getElementById("c").getContext("2d"); +ctx.fillText("Hello world!", 50, 50); +</script> +</body> +</html> diff --git a/dom/canvas/crashtests/789933-1.html b/dom/canvas/crashtests/789933-1.html new file mode 100644 index 000000000..a5f2f3437 --- /dev/null +++ b/dom/canvas/crashtests/789933-1.html @@ -0,0 +1,13 @@ +<!DOCTYPE html> +<html> +<body> +<canvas id="c" width="5000" height="20000"> +</canvas> +<script> +var ctxt = document.getElementById('c').getContext('2d'); +ctxt.strokeStyle = "Red"; +ctxt.font = "bold 16px Arial"; +ctxt.strokeText('Hello World!', 100, 100); +</script> +</body> +</html> diff --git a/dom/canvas/crashtests/794463-1.html b/dom/canvas/crashtests/794463-1.html new file mode 100644 index 000000000..5726baa74 --- /dev/null +++ b/dom/canvas/crashtests/794463-1.html @@ -0,0 +1,17 @@ +<!-- Any copyright is dedicated to the Public Domain. + - http://creativecommons.org/publicdomain/zero/1.0/ --> + +<!doctype HTML> +<html> +<body> +<canvas id="c" width="100" height="100"></canvas> +<script> +var c = document.getElementById("c"); +var ctx = c.getContext("2d"); +var p = ctx.createPattern(c, "no-repeat"); +ctx.rect(0, 0, 100, 100); +ctx.fillStyle = p; +ctx.fill(); +</script> +</body> +</html> diff --git a/dom/canvas/crashtests/802926-1.html b/dom/canvas/crashtests/802926-1.html new file mode 100644 index 000000000..a42ca50c1 --- /dev/null +++ b/dom/canvas/crashtests/802926-1.html @@ -0,0 +1,6 @@ +<!DOCTYPE html> +<script> + +document.createElement('canvas').toBlob(null); + +</script> diff --git a/dom/canvas/crashtests/896047-1.html b/dom/canvas/crashtests/896047-1.html new file mode 100644 index 000000000..2b121b227 --- /dev/null +++ b/dom/canvas/crashtests/896047-1.html @@ -0,0 +1,17 @@ +<!DOCTYPE html>
+<html>
+<body>
+<canvas id="c" width="200" height="100">
+</canvas>
+<script>
+var ctx = document.getElementById("c").getContext("2d");
+ctx.save();
+ctx.save();
+ctx.rect(0,0, 1,1);
+ctx.restore();
+ctx.fill('evenodd');
+ctx.restore();
+ctx.lineTo(10, 0);
+</script>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/896047-2.html b/dom/canvas/crashtests/896047-2.html new file mode 100644 index 000000000..4cd12dfb4 --- /dev/null +++ b/dom/canvas/crashtests/896047-2.html @@ -0,0 +1,19 @@ +<!DOCTYPE html>
+<html>
+<body>
+<canvas id="c" width="200" height="100">
+</canvas>
+<script>
+var ctx = document.getElementById("c").getContext("2d");
+ctx.save();
+ctx.mozFillRule = 'nonzero';
+ctx.save();
+ctx.mozFillRule = 'evenodd';
+ctx.rect(0,0, 1,1);
+ctx.restore();
+ctx.isPointInPath(0,0);
+ctx.restore();
+ctx.lineTo(10, 0);
+</script>
+</body>
+</html>
diff --git a/dom/canvas/crashtests/916128-1.html b/dom/canvas/crashtests/916128-1.html new file mode 100644 index 000000000..cddd5185e --- /dev/null +++ b/dom/canvas/crashtests/916128-1.html @@ -0,0 +1,13 @@ +<script> +o0 = document.createElement('canvas'); +(document.body || document.documentElement).appendChild(o0); +o1 = o0.getContext('2d'); +o2 = document.createElement('img'); +//o2.src = "image2.png"; +o3 = o1.createImageData(0.7409945472006207, 0.8815588599260801); +o1.save(); +o1.mozCurrentTransform = [0.18777365986904448, 4, 4, -2048, 3, 32]; +o0.width = 0.52; +o1.putImageData(o3, -32, -0.16596290333335356); +o0.toBlob(function() {}, "video/mp4", 16); +</script> diff --git a/dom/canvas/crashtests/934939-1.html b/dom/canvas/crashtests/934939-1.html new file mode 100644 index 000000000..d2ffbf475 --- /dev/null +++ b/dom/canvas/crashtests/934939-1.html @@ -0,0 +1,8 @@ +<script type="text/javascript"> + function run() { + var cx = canvas.getContext("2d"); + canvas.toDataURL("image/png"); + } +</script> +<body onload="run()"> +<canvas width="1" height="65536" id="canvas"></canvas> diff --git a/dom/canvas/crashtests/crashtests.list b/dom/canvas/crashtests/crashtests.list new file mode 100644 index 000000000..9da7dafa1 --- /dev/null +++ b/dom/canvas/crashtests/crashtests.list @@ -0,0 +1,44 @@ +load 0px-size-font-667225.html +load 0px-size-font-shadow.html +load 360293-1.html +load 421715-1.html +load 553938-1.html +load 647480.html +load 727547.html +load 729116.html +load 745699-1.html +load 746813-1.html +load 743499-negative-size.html +skip-if(Android) load 745818-large-source.html # Bug XXX - Crashes Android mid-run w/o a stack +load 767337-1.html +load 779426.html +skip-if(Android) load 780392-1.html +skip-if(Android) skip-if(gtkWidget&&isDebugBuild) load 789933-1.html # bug 1155252 for linux +load 794463-1.html +load 802926-1.html +load 896047-1.html +load 916128-1.html +load 934939-1.html +load 1099143-1.html +load 1161277-1.html +load 1183363.html +load 1190705.html +load 1223740-1.html +load 1225381-1.html +skip-if(azureCairo) load 1229983-1.html +load 1229932-1.html +load 1244850-1.html +load 1246775-1.html +load 1284356-1.html +load 1284578-1.html +skip-if(d2d) load 1287515-1.html +load 1287652-1.html +load 1288872-1.html +load 1290628-1.html +load 1283113-1.html +load 1286458-1.html +load 1299062-1.html +load 1305312-1.html +load 1298576-1.html +load 1334647-1.html +load 1357092.html diff --git a/dom/canvas/crashtests/texImage2D.html b/dom/canvas/crashtests/texImage2D.html new file mode 100644 index 000000000..370b00857 --- /dev/null +++ b/dom/canvas/crashtests/texImage2D.html @@ -0,0 +1,8 @@ +<!doctype html> +<canvas></canvas> +<script> +var canvas = document.body.firstChild, + gl = canvas.getContext("experimental-webgl"); +gl.texImage2D(0, 0, 0, 0, 0, { get width() { throw 7 }, get height() { throw 7 }, data: new Uint8ClampedArray(10) }); +gl.texSubImage2D(0, 0, 0, 0, 0, 0, { get width() { throw 7 }, get height() { throw 7 }, data: new Uint8ClampedArray(10) }); +</script> |