summaryrefslogtreecommitdiffstats
path: root/dom/svg/crashtests/long-clipPath-reference-chain.svg
diff options
context:
space:
mode:
authorMatt A. Tobin <mattatobin@localhost.localdomain>2018-02-02 04:16:08 -0500
committerMatt A. Tobin <mattatobin@localhost.localdomain>2018-02-02 04:16:08 -0500
commit5f8de423f190bbb79a62f804151bc24824fa32d8 (patch)
tree10027f336435511475e392454359edea8e25895d /dom/svg/crashtests/long-clipPath-reference-chain.svg
parent49ee0794b5d912db1f95dce6eb52d781dc210db5 (diff)
downloadUXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.gz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.lz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.xz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.zip
Add m-esr52 at 52.6.0
Diffstat (limited to 'dom/svg/crashtests/long-clipPath-reference-chain.svg')
-rw-r--r--dom/svg/crashtests/long-clipPath-reference-chain.svg53
1 files changed, 53 insertions, 0 deletions
diff --git a/dom/svg/crashtests/long-clipPath-reference-chain.svg b/dom/svg/crashtests/long-clipPath-reference-chain.svg
new file mode 100644
index 000000000..31a587c74
--- /dev/null
+++ b/dom/svg/crashtests/long-clipPath-reference-chain.svg
@@ -0,0 +1,53 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+ <title>Test very long clipPath chain - MAY CRASH</title>
+ <script><![CDATA[
+
+// This script creates a very long chain of clipPath elements to test whether
+// that causes a stack overflow that crashes the UA. The first clipPath clips
+// to a 50x100 rect, the last to a 25x100 rect. If a UA was to apply the
+// entire clipPath chain (unlikely) a rect 25x100 would be rendered.
+//
+// At the time of writing, Firefox would treat the entire chain of clipPaths as
+// invalid due to its excessive length, and refuse to render the referencing
+// element at all. One alternative would be to ignore the clipPath reference
+// and render the referencing element without any clipping. Another
+// alternative would be to break the chain and clip the referencing element,
+// but only using the first X clipPaths in the chain (in which case a 50x100
+// rect would be rendered).
+
+var chainLength = 100000;
+
+var SVG_NS = "http://www.w3.org/2000/svg";
+var template = document.createElementNS(SVG_NS, "clipPath");
+var templatesRect = document.createElementNS(SVG_NS, "rect");
+templatesRect.setAttribute("width", "100");
+templatesRect.setAttribute("height", "100");
+template.appendChild(templatesRect);
+
+function createClipPath(index) {
+ var cp = template.cloneNode(true);
+ cp.id = "c" + index;
+ cp.setAttribute("clip-path", "url(#c" + (index + 1) + ")");
+ return cp;
+}
+
+var de = document.documentElement;
+
+for (var i = chainLength; i > 0; --i) {
+ var cp = createClipPath(i);
+
+ if (i == chainLength) {
+ cp.firstChild.setAttribute("width", "25");
+ }
+ else if (i == 1) {
+ cp.firstChild.setAttribute("width", "50");
+ }
+
+ de.appendChild(cp);
+}
+
+ ]]></script>
+ <rect width="100%" height="100%" fill="lime"/>
+ <!-- We don't expect the following element to render at all -->
+ <rect width="500" height="500" clip-path="url(#c1)"/>
+</svg>